Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/

Overview

General Information

Sample URL:https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/
Analysis ID:1430567
Infos:

Detection

Score:8
Range:0 - 100
Whitelisted:false
Confidence:20%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)
Connects to several IPs in different countries
Creates files inside the system directory
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found iframes
HTML title does not match URL
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Stores files to the Windows start menu directory
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis
Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 7120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5536 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6904 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • TB_Free_Installer_20240423.17139028322183b390.exe (PID: 4344 cmdline: "C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exe" MD5: B9A625522B3DBDE8B3DAF4CDA02AA696)
      • EDownloader.exe (PID: 1832 cmdline: "C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe" EXEDIR=C:\Users\user\Downloads ||| EXENAME=TB_Free_Installer_20240423.17139028322183b390.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0 MD5: 53832E0D7970B48218429C20777D3965)
        • InfoForSetup.exe (PID: 2336 cmdline: /Uid "S-1-5-21-2246122658-3693405117-2476756634-1003" MD5: AF8A1F5CAF9C8411D3EEE07007450910)
        • InfoForSetup.exe (PID: 1508 cmdline: /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"Switzerland\",\"Timezone\":\"GMT+01:00\"}" MD5: AF8A1F5CAF9C8411D3EEE07007450910)
          • AliyunWrapExe.exe (PID: 3028 cmdline: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.Exe MD5: 1B6DA142052F6736F7A657149DE75BEE)
        • InfoForSetup.exe (PID: 7572 cmdline: /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"2\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17139028322183b390&lang=English&pcVersion=home&pid=3&tid=1&version=free\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"3\\",\\"version\\":\\"free\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"curNum\\":\\"2024\\",\\"testid\\":\\"123\\",\\"configid\\":\\"\\",\\"md5\\":\\"A78798643AC0FFE5765110D598F79549\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"url\\":[]},\\"time\\":1713902843}\",\"Result\":\"Success\"}" MD5: AF8A1F5CAF9C8411D3EEE07007450910)
        • InfoForSetup.exe (PID: 3904 cmdline: /SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"Switzerland\",\"Install_Path\":\"C:/Program Files (x86)/EaseUS/Todo Backup\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17139028322183b390\",\"Timezone\":\"GMT+01:00\",\"Version\":\"free\",\"Version_Num\":\"2024\"}" MD5: AF8A1F5CAF9C8411D3EEE07007450910)
        • InfoForSetup.exe (PID: 7404 cmdline: /SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Pageid\":\"17139028322183b390\",\"Version\":\"free\"}" MD5: AF8A1F5CAF9C8411D3EEE07007450910)
        • InfoForSetup.exe (PID: 7280 cmdline: /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"11.35MB\",\"Cdn\":\"https://d1.easeus.com/tb/free/TodoBackup16.1.1_free.exe\",\"Elapsedtime\":\"13\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}" MD5: AF8A1F5CAF9C8411D3EEE07007450910)
        • InfoForSetup.exe (PID: 7292 cmdline: /SendInfo Window "Installing" Activity "Info_Start_Install_Program" MD5: AF8A1F5CAF9C8411D3EEE07007450910)
        • TB_free_easeus.exe (PID: 7288 cmdline: /verysilent /DIR="C:\Program Files (x86)\EaseUS\Todo Backup" /IMAGEPATH="C:\My Backups" /LANG=English agreeImprove=true GUID=S-1-5-21-2246122658-3693405117-2476756634-1003 xurlID=17139028322183b390 MD5: A78798643AC0FFE5765110D598F79549)
          • TB_free_easeus.tmp (PID: 4132 cmdline: "C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp" /SL5="$30136,154092718,171008,C:\Users\user\Downloads\TB_free_easeus.exe" /verysilent /DIR="C:\Program Files (x86)\EaseUS\Todo Backup" /IMAGEPATH="C:\My Backups" /LANG=English agreeImprove=true GUID=S-1-5-21-2246122658-3693405117-2476756634-1003 xurlID=17139028322183b390 MD5: 23AD08B186C95358DEA1F1E3FDA5AFAA)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902771290&cv=11&fst=1713902771290&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902771304&cv=11&fst=1713902771304&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=800478534
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902771290&cv=11&fst=1713902771290&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902771304&cv=11&fst=1713902771304&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=800478534
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag&us_privacy=1---#{"bundle":{"origin":0,"value":null},"cw":true,"optout":{"origin":0,"value":null},"origin":"onetag","sid":{"origin":0,"value":null},"tld":"easeus.com","topUrl":"www.easeus.com","version":"5_23_0","ifa":{"origin":0,"value":null},"lsw":true,"pm":0}
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=4jp3gXxENE1RVlpMWi96OEV5YzB4V2VPV3lNVUJMWWllU0FadWZORzZjdjkwUjZubk1GQmgyN1AzUUs0eDRZc0FrL1JjSjJnQVFNMllpcGx1Q3lsQzhGZzlBaWlCMDFoTDZnRzBYcnN1UGNPYU9xMk5MV1JPUzBLMGVPbFU0MFJEdlEwRlkzMXhFREFEMXpjaGwyVlBONGsweldCWkJ4cU56bjRqT1dkZllUajNFNmcwUFVxRzlCR01qcXl5bG1OL2hCdkZ3LzBubjE4SGFibDFZYmlSNjk2WEZnPT18
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://mc.yandex.com/metrika/metrika_match.html
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902771290&cv=11&fst=1713902771290&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902771304&cv=11&fst=1713902771304&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=800478534
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag&us_privacy=1---#{"bundle":{"origin":0,"value":null},"cw":true,"optout":{"origin":0,"value":null},"origin":"onetag","sid":{"origin":0,"value":null},"tld":"easeus.com","topUrl":"www.easeus.com","version":"5_23_0","ifa":{"origin":0,"value":null},"lsw":true,"pm":0}
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=4jp3gXxENE1RVlpMWi96OEV5YzB4V2VPV3lNVUJMWWllU0FadWZORzZjdjkwUjZubk1GQmgyN1AzUUs0eDRZc0FrL1JjSjJnQVFNMllpcGx1Q3lsQzhGZzlBaWlCMDFoTDZnRzBYcnN1UGNPYU9xMk5MV1JPUzBLMGVPbFU0MFJEdlEwRlkzMXhFREFEMXpjaGwyVlBONGsweldCWkJ4cU56bjRqT1dkZllUajNFNmcwUFVxRzlCR01qcXl5bG1OL2hCdkZ3LzBubjE4SGFibDFZYmlSNjk2WEZnPT18
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://mc.yandex.com/metrika/metrika_match.html
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902771290&cv=11&fst=1713902771290&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902771304&cv=11&fst=1713902771304&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=800478534
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag&us_privacy=1---#{"bundle":{"origin":0,"value":null},"cw":true,"optout":{"origin":0,"value":null},"origin":"onetag","sid":{"origin":0,"value":null},"tld":"easeus.com","topUrl":"www.easeus.com","version":"5_23_0","ifa":{"origin":0,"value":null},"lsw":true,"pm":0}
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=4jp3gXxENE1RVlpMWi96OEV5YzB4V2VPV3lNVUJMWWllU0FadWZORzZjdjkwUjZubk1GQmgyN1AzUUs0eDRZc0FrL1JjSjJnQVFNMllpcGx1Q3lsQzhGZzlBaWlCMDFoTDZnRzBYcnN1UGNPYU9xMk5MV1JPUzBLMGVPbFU0MFJEdlEwRlkzMXhFREFEMXpjaGwyVlBONGsweldCWkJ4cU56bjRqT1dkZllUajNFNmcwUFVxRzlCR01qcXl5bG1OL2hCdkZ3LzBubjE4SGFibDFZYmlSNjk2WEZnPT18
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Iframe src: https://mc.yandex.com/metrika/metrika_match.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{"bundle":{"origin":3,"value":"WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q"},"cw":true,"optout":{"origin":0,"value":null},"origin":"onetag","sid":{"origin":0,"value":null},"tld":"easeus.com","topUrl":"www.easeus.com","version":"5_23_0","ifa":{"origin":0,"value":null},"lsw":true,"pm":0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{"bundle":{"origin":3,"value":"WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q"},"cw":true,"optout":{"origin":0,"value":null},"origin":"onetag","sid":{"origin":0,"value":null},"tld":"easeus.com","topUrl":"www.easeus.com","version":"5_23_0","ifa":{"origin":0,"value":null},"lsw":true,"pm":0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902809909&cv=11&fst=1713902809909&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902813625&cv=11&fst=1713902813625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902809909&cv=11&fst=1713902809909&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902813625&cv=11&fst=1713902813625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902809909&cv=11&fst=1713902809909&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902813625&cv=11&fst=1713902813625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902809909&cv=11&fst=1713902809909&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902813625&cv=11&fst=1713902813625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902825617&cv=11&fst=1713902825617&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902825625&cv=11&fst=1713902825625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902832134&cv=11&fst=1713902832134&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902832147&cv=11&fst=1713902832147&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1598135840
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902809909&cv=11&fst=1713902809909&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902813625&cv=11&fst=1713902813625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902825617&cv=11&fst=1713902825617&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902825625&cv=11&fst=1713902825625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902809909&cv=11&fst=1713902809909&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902813625&cv=11&fst=1713902813625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902825617&cv=11&fst=1713902825617&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902825625&cv=11&fst=1713902825625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902832134&cv=11&fst=1713902832134&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902832147&cv=11&fst=1713902832147&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1598135840
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902809909&cv=11&fst=1713902809909&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902813625&cv=11&fst=1713902813625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902825617&cv=11&fst=1713902825617&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902825625&cv=11&fst=1713902825625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902832134&cv=11&fst=1713902832134&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902832147&cv=11&fst=1713902832147&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1598135840
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hide
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=dark
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902809909&cv=11&fst=1713902809909&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902813625&cv=11&fst=1713902813625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902825617&cv=11&fst=1713902825617&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902825625&cv=11&fst=1713902825625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1064956115?random=1713902832134&cv=11&fst=1713902832134&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11113079898?random=1713902832147&cv=11&fst=1713902832147&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
Source: https://www.easeus.com/backup-software/HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1598135840
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: Title: File not found does not match URL
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=darkHTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/1064956115?random=1713902771290&cv=11&fst=1713902771290&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.configHTTP Parser: No favicon
Source: https://fledge.us.criteo.com/interest-group?data=4jp3gXxENE1RVlpMWi96OEV5YzB4V2VPV3lNVUJMWWllU0FadWZORzZjdjkwUjZubk1GQmgyN1AzUUs0eDRZc0FrL1JjSjJnQVFNMllpcGx1Q3lsQzhGZzlBaWlCMDFoTDZnRzBYcnN1UGNPYU9xMk5MV1JPUzBLMGVPbFU0MFJEdlEwRlkzMXhFREFEMXpjaGwyVlBONGsweldCWkJ4cU56bjRqT1dkZllUajNFNmcwUFVxRzlCR01qcXl5bG1OL2hCdkZ3LzBubjE4SGFibDFZYmlSNjk2WEZnPT18HTTP Parser: No favicon
Source: https://mc.yandex.com/metrika/metrika_match.htmlHTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=darkHTTP Parser: No favicon
Source: https://www.easeus.com/backup-software/HTTP Parser: No favicon
Source: about:blankHTTP Parser: No favicon
Source: https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hideHTTP Parser: No favicon
Source: https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18HTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.configHTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_bannerHTTP Parser: No favicon
Source: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0HTTP Parser: No favicon
Source: https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0HTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/1064956115?random=1713902825617&cv=11&fst=1713902825617&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popupHTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/1064956115?random=1713902832134&cv=11&fst=1713902832134&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popupHTTP Parser: No favicon
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="author".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: https://www.easeus.com/backup-software/HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: unknownHTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49833 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49843 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49844 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:50041 version: TLS 1.2
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\SysWOW64\KERNELBASE.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097\gdiplus.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\SysWOW64\KERNEL32.DLL
Source: unknownNetwork traffic detected: IP country count 11
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownDNS traffic detected: queries for: www.easeus.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
Source: unknownNetwork traffic detected: HTTP traffic on port 49932 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50154 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50234 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 50165 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50074 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50107 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49969
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49968
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49964
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
Source: unknownNetwork traffic detected: HTTP traffic on port 50120 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
Source: unknownNetwork traffic detected: HTTP traffic on port 50040 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50189 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50246 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50130 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50108 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 49921 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49955
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 50062 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 50119 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
Source: unknownNetwork traffic detected: HTTP traffic on port 50142 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50051 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50178 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50153 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49955 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 50210 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50235 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49948
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 50061 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49945 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50017 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49968 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50187 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 50144 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49894
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49891
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49890
Source: unknownNetwork traffic detected: HTTP traffic on port 50209 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50247 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50095 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50155 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50084 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
Source: unknownNetwork traffic detected: HTTP traffic on port 50166 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
Source: unknownNetwork traffic detected: HTTP traffic on port 50143 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
Source: unknownNetwork traffic detected: HTTP traffic on port 50208 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50050 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50110 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50236 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50083 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
Source: unknownNetwork traffic detected: HTTP traffic on port 50188 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50220 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50109 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50072 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50132 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50027 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50199 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
Source: unknownNetwork traffic detected: HTTP traffic on port 50013 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50036 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50174 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50139 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50151 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50210
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50212
Source: unknownNetwork traffic detected: HTTP traffic on port 50225 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50059 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50202 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50094 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50071 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50227
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50226
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50108
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50229
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50107
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50228
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50060 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50109
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50100
Source: unknownNetwork traffic detected: HTTP traffic on port 50186 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50220
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50102
Source: unknownNetwork traffic detected: HTTP traffic on port 50243 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50225
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50103
Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49964 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50197 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50117
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50238
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50237
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50119
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50118
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50239
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50230
Source: unknownNetwork traffic detected: HTTP traffic on port 49918 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50111
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50232
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50110
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50231
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50113
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50234
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50112
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50233
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50236
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50114
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50235
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49963 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50127 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50198 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50232 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 50037 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50012 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50127
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50248
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50129
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50120
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50241
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 50093 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50240
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50243
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50242
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50124
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50245
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50123
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50126
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50247
Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50125
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50246
Source: unknownNetwork traffic detected: HTTP traffic on port 50048 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50082 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50164 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50129 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50184 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49965 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50081 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50117 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50152 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50070 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50201 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50141 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50212 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50233 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50118 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50092 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50200 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50047 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49908 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50140 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50205
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50207
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50196 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50206
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50209
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50208
Source: unknownNetwork traffic detected: HTTP traffic on port 50245 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49931 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50058 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50201
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50200
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50202
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50185 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50069 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50174
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50058
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50057
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50178
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50059
Source: unknownNetwork traffic detected: HTTP traffic on port 50022 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50061
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50182
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50060
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50181
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50063
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50184
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50062
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50183
Source: unknownNetwork traffic detected: HTTP traffic on port 50068 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50102 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50125 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49950 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50010 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50148 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50186
Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50185
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50067
Source: unknownNetwork traffic detected: HTTP traffic on port 50113 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50188
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50187
Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50069
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50068
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50189
Source: unknownNetwork traffic detected: HTTP traffic on port 50205 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50240 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50183 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50070
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50191
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50190
Source: unknownNetwork traffic detected: HTTP traffic on port 49915 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50072
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50193
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50071
Source: unknownNetwork traffic detected: HTTP traffic on port 50159 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50074
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50080 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50227 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50197
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50075
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50196
Source: unknownNetwork traffic detected: HTTP traffic on port 50057 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50078
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50199
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50077
Source: unknownNetwork traffic detected: HTTP traffic on port 50114 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50198
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50079
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50081
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50080
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50083
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50082
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50084
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50087
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50086
Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50089
Source: unknownNetwork traffic detected: HTTP traffic on port 50079 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50090
Source: unknownNetwork traffic detected: HTTP traffic on port 50241 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50092
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50094
Source: unknownNetwork traffic detected: HTTP traffic on port 50136 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50093
Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50095
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50139
Source: unknownNetwork traffic detected: HTTP traffic on port 50170 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50017
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50138
Source: unknownNetwork traffic detected: HTTP traffic on port 50193 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50019
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50032 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50010
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50130
Source: unknownNetwork traffic detected: HTTP traffic on port 49916 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50012
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50133
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50132
Source: unknownNetwork traffic detected: HTTP traffic on port 50090 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50135
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50013
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50134
Source: unknownNetwork traffic detected: HTTP traffic on port 50078 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50137
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50136
Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50140
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50230 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50029
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50142
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50141
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50144
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50022
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50143
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50145
Source: unknownNetwork traffic detected: HTTP traffic on port 50226 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50027
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50148
Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50026
Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50021 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50151
Source: unknownNetwork traffic detected: HTTP traffic on port 50138 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50067 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50103 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50011 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50032
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50153
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50031
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50152
Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50155
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50154
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50036
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50157
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50035
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50156
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50038
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50159
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50037
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50158
Source: unknownNetwork traffic detected: HTTP traffic on port 50182 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50242 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49940 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50041
Source: unknownNetwork traffic detected: HTTP traffic on port 50137 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50040
Source: unknownNetwork traffic detected: HTTP traffic on port 50089 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49891 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50171 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50043
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50164
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49917 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50042
Source: unknownHTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49833 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49843 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49844 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:50041 version: TLS 1.2
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-QT4GM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Windows\system32\is-TMN05.tmp
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: classification engineClassification label: clean8.win@54/606@273/712
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\TB_p2p_Setup
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\C$$USERS$user$APPDATA$LOCAL$TEMP$DOWNLOADER_EASEUS$1.0.0$3FREE$ALIYUN$ALIYUNCONFIG.INI
Source: C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exeFile created: C:\Users\user\AppData\Local\Temp\nslB65.tmp
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeFile read: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunConfig.ini
Source: C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5536 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5536 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6904 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exe "C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exe"
Source: C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe "C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe" EXEDIR=C:\Users\user\Downloads ||| EXENAME=TB_Free_Installer_20240423.17139028322183b390.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /Uid "S-1-5-21-2246122658-3693405117-2476756634-1003"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6904 --field-trial-handle=1976,i,11472516180265904078,11172139182499430019,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"Switzerland\",\"Timezone\":\"GMT+01:00\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exe C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.Exe
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"2\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17139028322183b390&lang=English&pcVersion=home&pid=3&tid=1&version=free\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"3\\",\\"version\\":\\"free\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"curNum\\":\\"2024\\",\\"testid\\":\\"123\\",\\"configid\\":\\"\\",\\"md5\\":\\"A78798643AC0FFE5765110D598F79549\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"url\\":[]},\\"time\\":1713902843}\",\"Result\":\"Success\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"Switzerland\",\"Install_Path\":\"C:/Program Files (x86)/EaseUS/Todo Backup\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17139028322183b390\",\"Timezone\":\"GMT+01:00\",\"Version\":\"free\",\"Version_Num\":\"2024\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Pageid\":\"17139028322183b390\",\"Version\":\"free\"}"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exe "C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exe"
Source: C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe "C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe" EXEDIR=C:\Users\user\Downloads ||| EXENAME=TB_Free_Installer_20240423.17139028322183b390.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"11.35MB\",\"Cdn\":\"https://d1.easeus.com/tb/free/TodoBackup16.1.1_free.exe\",\"Elapsedtime\":\"13\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Installing" Activity "Info_Start_Install_Program"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\Downloads\TB_free_easeus.exe /verysilent /DIR="C:\Program Files (x86)\EaseUS\Todo Backup" /IMAGEPATH="C:\My Backups" /LANG=English agreeImprove=true GUID=S-1-5-21-2246122658-3693405117-2476756634-1003 xurlID=17139028322183b390
Source: C:\Users\user\Downloads\TB_free_easeus.exeProcess created: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp "C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp" /SL5="$30136,154092718,171008,C:\Users\user\Downloads\TB_free_easeus.exe" /verysilent /DIR="C:\Program Files (x86)\EaseUS\Todo Backup" /IMAGEPATH="C:\My Backups" /LANG=English agreeImprove=true GUID=S-1-5-21-2246122658-3693405117-2476756634-1003 xurlID=17139028322183b390
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"Switzerland\",\"Timezone\":\"GMT+01:00\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"2\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17139028322183b390&lang=English&pcVersion=home&pid=3&tid=1&version=free\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"3\\",\\"version\\":\\"free\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"curNum\\":\\"2024\\",\\"testid\\":\\"123\\",\\"configid\\":\\"\\",\\"md5\\":\\"A78798643AC0FFE5765110D598F79549\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/tb\\/free\\/TodoBackup16.1.1_free.exe\\",\\"url\\":[]},\\"time\\":1713902843}\",\"Result\":\"Success\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"Switzerland\",\"Install_Path\":\"C:/Program Files (x86)/EaseUS/Todo Backup\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17139028322183b390\",\"Timezone\":\"GMT+01:00\",\"Version\":\"free\",\"Version_Num\":\"2024\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Pageid\":\"17139028322183b390\",\"Version\":\"free\"}"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Downloading" Activity "Result_Download_Program" Attribute "{\"Average_Networkspeed\":\"11.35MB\",\"Cdn\":\"https://d1.easeus.com/tb/free/TodoBackup16.1.1_free.exe\",\"Elapsedtime\":\"13\",\"Errorinfo\":\"0\",\"Result\":\"Success\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /SendInfo Window "Installing" Activity "Info_Start_Install_Program"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\Downloads\TB_free_easeus.exe /verysilent /DIR="C:\Program Files (x86)\EaseUS\Todo Backup" /IMAGEPATH="C:\My Backups" /LANG=English agreeImprove=true GUID=S-1-5-21-2246122658-3693405117-2476756634-1003 xurlID=17139028322183b390
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: msiso.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: mshtml.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: srpapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: msimtf.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: d2d1.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: aliyunwrap.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpSection loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32
Source: C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exeFile written: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\Malay.ini
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpWindow found: window name: TMainForm
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\SysWOW64\msftedit.dll
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7LGK0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6HA19.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JHQ4N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RFQVO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-776R2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-FTF07.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3GEFV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T27CQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VP44V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SRLMP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LVLR9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BA2NJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5NFI8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RJPQM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-F75KB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SKJ5M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-U53AK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9JUDT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JH069.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ONQ9N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-4GO4G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-A99MS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NSR50.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NP1QC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6A81G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile created: C:\Users\user\Downloads\TB_free_easeus.exe.tempJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-30Q8E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2CR4U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4SO60.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CICTF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7KBC7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4U7OG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JUU14.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6Q2L9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BHP96.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\is-HLN60.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2P5OL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-1KF51.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PGH7M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AA45F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QUVG6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-5NJS0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2413K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DFFS4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-VUDE4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8CIIF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-41UF1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J1TL9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-O7H5R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-S2JLI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5BR6G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-93U17.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MNN08.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QJF4F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IGCVJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ALNIR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-04TMO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-K1CUF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UF2QQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-FRMBO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-M1F59.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-127NI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PTHJ8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PIE86.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1N5OG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-FRKA2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A8VQO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LKUFG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LMB1G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UQR38.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-725FO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-47EEO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1OMHH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UQLUB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-T63TT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BSCFV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GJAP3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GACLS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9AK69.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-QAD3U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HLN36.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BRKC5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5CGGI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8FNSC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UK8GF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-O2UCC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-24FIA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-U0Q12.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J6DTU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OB6O8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NUPBA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QEK86.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RU67E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LSR9V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8EI4U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DK09K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9FFJH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-T9U8D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-151GI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q6CRH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6O9EV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-7NJGF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4ACJ3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ODCA3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9N7VG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LE083.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J137C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HVFFB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7BG7D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-91N14.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-HLF99.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-52N81.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-B3QPI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-H564L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QMON9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IFM27.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-1FUP0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NLGRQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-89GIS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TH43L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OFBI6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0V2BJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LOG3L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8DHNS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P6P07.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B02CC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-48G08.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ONK4G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A1HFI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-JIO6O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PEA4S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ANJBD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6CE3K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BBPJ6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C6MV1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6L87R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BRP9L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-79K96.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2BVR2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-505CN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\TBFirewall.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TT6IV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3BJOU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PIGQC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-MSQHD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OGLO4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4A6QT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0TAB9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4KBC7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-71J6G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-25KT5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OPDVO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SCAQ1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-96BJ9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LP1OB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GKIDG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-IN45A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QKKTU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CLQEB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DHH6O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-1NFCE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-20SLO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OFMNI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-G4SG4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4PTPN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-82JCC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2E41F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-A3RLR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1KK0P.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PN7VE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-V9270.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-E4L6V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DU13M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7SVLL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BBNRU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SAEB2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BPQE8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CIS5G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OGD22.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-JC1B0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2CG5H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ETQ91.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KLM5F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KS57B.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-827NN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J19EC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-70AL7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7N5IM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DNJ0U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-REBNB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GJCK2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-42D15.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\EaseUSToolDll.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T089L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5N3SR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VROD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RVMPC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IIMH3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5T2DR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ABGAJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-5V464.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UV3HJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R1GCB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VEDLT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P63FK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\BUILDPE\EaseUS-x64\tb\bin\is-FSMH5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2IUFE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8A8JE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D0TCV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IT7DH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-QIG7J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-N5ECB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-Q3QDO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3QBU3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4JL1E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J1L89.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J7OJA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VKE9V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5DOTB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-91MRO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q376I.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RHB7P.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-KP53P.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8JNB5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GCQG2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T2UEV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NOOCH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KGRDP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HDHPK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GUIII.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-59S61.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3K905.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LTDG9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LGHNL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5ARLJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BD9O5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DA21K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5292O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-M6ABI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A9M9F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CRJCF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-HJRN2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Windows\System32\is-TMN05.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JE6UF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-D5255.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UKT53.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D60HO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LQOGV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NIP0M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-N7H5K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B9G3T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PU249.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RV55T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6ENEU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TBEMF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LK099.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PFLD8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-IF1J1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AOS3D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DBH01.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LCTST.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-R82R0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IF66L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CFC5M.tmpJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\Unconfirmed 979515.crdownloadJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6RRCF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SB347.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UT1SD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-L7BS5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-96GCD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-65H2S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4EHV1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CAMT1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-032HF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IMFS9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-S91PS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C06JV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DG7RH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VOFA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QQRUA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5IHER.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7KOJF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TJRMJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-424HV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BMCT2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NUM9I.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-19TAL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R0INC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-31S3C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NNDRG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GV94K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NTEGE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C3AJ2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SJ54O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CQ1FT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4OV1T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-95DS3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-93HAQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-49VCE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BD949.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ACD30.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-3VB1G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-3838S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q050A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JH7R3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-SAG0F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-AH9DR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AOC02.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2TEB0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9QD7I.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JFN3L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CGBM2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9UUGF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2Q3GA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-0BKIV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DJORB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BG0LR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CM055.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BK9TS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0VKK6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-H203L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ACCV7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\_isetup\_shfoldr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6FK0U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OQEG2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8GORL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7C2SF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CPCGC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J97EA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SJG3V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4CCFO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-I936D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-70GJM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4NOHR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AM2KJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-Q3TE4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7IDJ7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-3SI6I.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-TVA30.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SUS9J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LAIV4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-S4ATD.tmpJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\3603311b-a1b1-454e-95bc-2313c83bd718.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6TOS7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2BM3F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B8191.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DADTJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-F8JB2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P3HRB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UHBJV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GKICP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-E1SDT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P1D83.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-VHI33.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\EuDriverMgr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-EPVIJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-19K5L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A2NEM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SMLAC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2IPO1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-48BPV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VKD48.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-22GF3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HNUE0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D83JQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NOB3N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MHLNO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-H9EE9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UTVDV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-G3MCU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-R8V0K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7ITIA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IOAPV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-F4B9A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BTT9D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ABATK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A0VGE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-24OUR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RSR84.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-10P6Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-88M7F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UJ0I8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VFRI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MMAME.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3DHJ8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QKS7C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-P0LHI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2J85E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KIIF1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P3FKA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DGQB0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-30V1U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R1L06.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-33791.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DO9UM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PCQL4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8EL2E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpFile created: C:\Windows\System32\is-TMN05.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile created: C:\Users\user\Downloads\TB_free_easeus.exe.temp
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile created: C:\Users\user\Downloads\TB_free_easeus.exe.tempJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeMemory allocated: 63F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7LGK0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6HA19.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JHQ4N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RFQVO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-776R2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-FTF07.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3GEFV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T27CQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VP44V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SRLMP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LVLR9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BA2NJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RJPQM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5NFI8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-F75KB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SKJ5M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-U53AK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9JUDT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JH069.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ONQ9N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-4GO4G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-A99MS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NSR50.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NP1QC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6A81G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeDropped PE file which has not been started: C:\Users\user\Downloads\TB_free_easeus.exe.temp
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-30Q8E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2CR4U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4SO60.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CICTF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4U7OG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7KBC7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JUU14.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6Q2L9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BHP96.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2P5OL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-1KF51.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PGH7M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AA45F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QUVG6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-5NJS0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2413K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DFFS4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-VUDE4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8CIIF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-41UF1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J1TL9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-S2JLI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-O7H5R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5BR6G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-93U17.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MNN08.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QJF4F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IGCVJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ALNIR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-04TMO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UF2QQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-K1CUF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-M1F59.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-FRMBO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PTHJ8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-127NI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PIE86.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1N5OG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-FRKA2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A8VQO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LKUFG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LMB1G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UQR38.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-725FO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-47EEO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1OMHH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UQLUB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-T63TT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BSCFV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GACLS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GJAP3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9AK69.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-QAD3U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HLN36.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BRKC5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5CGGI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8FNSC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-O2UCC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UK8GF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-24FIA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-U0Q12.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J6DTU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OB6O8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NUPBA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QEK86.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RU67E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LSR9V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8EI4U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DK09K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9FFJH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-T9U8D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-151GI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q6CRH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6O9EV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-7NJGF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4ACJ3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ODCA3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9N7VG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LE083.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J137C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HVFFB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7BG7D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-91N14.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-HLF99.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-52N81.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-B3QPI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-H564L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QMON9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IFM27.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-1FUP0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NLGRQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-89GIS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TH43L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OFBI6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0V2BJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LOG3L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8DHNS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P6P07.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-48G08.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B02CC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ONK4G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A1HFI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-JIO6O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PEA4S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ANJBD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6CE3K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C6MV1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BRP9L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BBPJ6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6L87R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-79K96.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2BVR2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-505CN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\TBFirewall.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TT6IV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3BJOU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PIGQC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-MSQHD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OGLO4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4A6QT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0TAB9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4KBC7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-71J6G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-25KT5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OPDVO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SCAQ1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-96BJ9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LP1OB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GKIDG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-IN45A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QKKTU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CLQEB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DHH6O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-1NFCE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-20SLO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OFMNI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-G4SG4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4PTPN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-82JCC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1KK0P.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2E41F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-A3RLR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PN7VE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-E4L6V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-V9270.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DU13M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7SVLL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BBNRU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SAEB2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BPQE8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CIS5G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OGD22.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-JC1B0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2CG5H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ETQ91.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KLM5F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KS57B.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-827NN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J19EC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-70AL7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7N5IM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DNJ0U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-REBNB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GJCK2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-42D15.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\EaseUSToolDll.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T089L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5N3SR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VROD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RVMPC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IIMH3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5T2DR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ABGAJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-5V464.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UV3HJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R1GCB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VEDLT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P63FK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\BUILDPE\EaseUS-x64\tb\bin\is-FSMH5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2IUFE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8A8JE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D0TCV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IT7DH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-QIG7J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-N5ECB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-Q3QDO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3QBU3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4JL1E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J1L89.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J7OJA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VKE9V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5DOTB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-91MRO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q376I.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RHB7P.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-KP53P.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GCQG2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8JNB5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T2UEV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NOOCH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KGRDP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HDHPK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-59S61.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GUIII.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3K905.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LTDG9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LGHNL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5ARLJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BD9O5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DA21K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5292O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-M6ABI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A9M9F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-HJRN2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CRJCF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Windows\System32\is-TMN05.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JE6UF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-D5255.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UKT53.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D60HO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LQOGV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NIP0M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-N7H5K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B9G3T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PU249.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6ENEU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RV55T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TBEMF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LK099.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PFLD8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-IF1J1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AOS3D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LCTST.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DBH01.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-R82R0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IF66L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CFC5M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6RRCF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SB347.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UT1SD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-L7BS5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-96GCD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-65H2S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4EHV1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CAMT1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-032HF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-S91PS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IMFS9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C06JV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DG7RH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VOFA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QQRUA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5IHER.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7KOJF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TJRMJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-424HV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BMCT2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NUM9I.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-19TAL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R0INC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-31S3C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NNDRG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GV94K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NTEGE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C3AJ2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SJ54O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CQ1FT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-95DS3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4OV1T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BD949.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-93HAQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-49VCE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ACD30.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-3VB1G.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-3838S.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q050A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JH7R3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-AH9DR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-SAG0F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AOC02.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2TEB0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9QD7I.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JFN3L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CGBM2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9UUGF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2Q3GA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-0BKIV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DJORB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CM055.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BG0LR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0VKK6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BK9TS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-H203L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ACCV7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\_isetup\_shfoldr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6FK0U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OQEG2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8GORL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7C2SF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CPCGC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J97EA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SJG3V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4CCFO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-I936D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-70GJM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4NOHR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-Q3TE4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AM2KJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7IDJ7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-3SI6I.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-TVA30.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SUS9J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LAIV4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-S4ATD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2BM3F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6TOS7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B8191.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-F8JB2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DADTJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P3HRB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UHBJV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-E1SDT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GKICP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-VHI33.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P1D83.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-EPVIJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\EuDriverMgr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-19K5L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A2NEM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SMLAC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2IPO1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-48BPV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VKD48.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-22GF3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HNUE0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D83JQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NOB3N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MHLNO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-H9EE9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UTVDV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-G3MCU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-R8V0K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7ITIA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IOAPV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-F4B9A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BTT9D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ABATK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A0VGE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-24OUR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RSR84.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-88M7F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-10P6Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UJ0I8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VFRI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MMAME.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3DHJ8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QKS7C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-P0LHI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2J85E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KIIF1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DGQB0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P3FKA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-30V1U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R1L06.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-33791.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DO9UM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PCQL4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpDropped PE file which has not been started: C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8EL2E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\SysWOW64\KERNELBASE.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097\gdiplus.dll
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeFile opened: C:\Windows\SysWOW64\KERNEL32.DLL
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess information queried: ProcessInformation
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmpProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /sendinfo window "home_installer" activity "result_download_configurefile" attribute "{\"cdn\":\"http://download.easeus.com/api2/index.php/apicp/drwdl202004/index/\",\"elapsed\":\"2\",\"errorinfo\":\"0\",\"posturl\":\"http://download.easeus.com/api2/index.php/apicp/drwdl202004/index/?exenumber=17139028322183b390&lang=english&pcversion=home&pid=3&tid=1&version=free\",\"responsejson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"3\\",\\"version\\":\\"free\\",\\"tj_download\\":\\"test\\",\\"refernumber\\":\\"1000000\\",\\"killswitch\\":\\"true\\",\\"writelogswitch\\":\\"false\\",\\"curnum\\":\\"2024\\",\\"testid\\":\\"123\\",\\"configid\\":\\"\\",\\"md5\\":\\"a78798643ac0ffe5765110d598f79549\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/tb\\/free\\/todobackup16.1.1_free.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/tb\\/free\\/todobackup16.1.1_free.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/tb\\/free\\/todobackup16.1.1_free.exe\\",\\"url\\":[]},\\"time\\":1713902843}\",\"result\":\"success\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /sendinfo window "home_installer" activity "click_install" attribute "{\"country\":\"switzerland\",\"install_path\":\"c:/program files (x86)/easeus/todo backup\",\"language\":\"english\",\"os\":\"microsoft windows 10\",\"pageid\":\"17139028322183b390\",\"timezone\":\"gmt+01:00\",\"version\":\"free\",\"version_num\":\"2024\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /sendinfo window "downloading" activity "result_download_program" attribute "{\"average_networkspeed\":\"11.35mb\",\"cdn\":\"https://d1.easeus.com/tb/free/todobackup16.1.1_free.exe\",\"elapsedtime\":\"13\",\"errorinfo\":\"0\",\"result\":\"success\"}"
Source: C:\Users\user\Downloads\TB_free_easeus.exeProcess created: C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp "c:\users\user\appdata\local\temp\is-2tu8e.tmp\tb_free_easeus.tmp" /sl5="$30136,154092718,171008,c:\users\user\downloads\tb_free_easeus.exe" /verysilent /dir="c:\program files (x86)\easeus\todo backup" /imagepath="c:\my backups" /lang=english agreeimprove=true guid=s-1-5-21-2246122658-3693405117-2476756634-1003 xurlid=17139028322183b390
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /sendinfo window "home_installer" activity "result_download_configurefile" attribute "{\"cdn\":\"http://download.easeus.com/api2/index.php/apicp/drwdl202004/index/\",\"elapsed\":\"2\",\"errorinfo\":\"0\",\"posturl\":\"http://download.easeus.com/api2/index.php/apicp/drwdl202004/index/?exenumber=17139028322183b390&lang=english&pcversion=home&pid=3&tid=1&version=free\",\"responsejson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"3\\",\\"version\\":\\"free\\",\\"tj_download\\":\\"test\\",\\"refernumber\\":\\"1000000\\",\\"killswitch\\":\\"true\\",\\"writelogswitch\\":\\"false\\",\\"curnum\\":\\"2024\\",\\"testid\\":\\"123\\",\\"configid\\":\\"\\",\\"md5\\":\\"a78798643ac0ffe5765110d598f79549\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/tb\\/free\\/todobackup16.1.1_free.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/tb\\/free\\/todobackup16.1.1_free.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/tb\\/free\\/todobackup16.1.1_free.exe\\",\\"url\\":[]},\\"time\\":1713902843}\",\"result\":\"success\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /sendinfo window "home_installer" activity "click_install" attribute "{\"country\":\"switzerland\",\"install_path\":\"c:/program files (x86)/easeus/todo backup\",\"language\":\"english\",\"os\":\"microsoft windows 10\",\"pageid\":\"17139028322183b390\",\"timezone\":\"gmt+01:00\",\"version\":\"free\",\"version_num\":\"2024\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeProcess created: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe /sendinfo window "downloading" activity "result_download_program" attribute "{\"average_networkspeed\":\"11.35mb\",\"cdn\":\"https://d1.easeus.com/tb/free/todobackup16.1.1_free.exe\",\"elapsedtime\":\"13\",\"errorinfo\":\"0\",\"result\":\"success\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeQueries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Drive-by Compromise		1
Command and Scripting Interpreter		1
Registry Run Keys / Startup Folder		1
Process Injection		33
Masquerading		OS Credential Dumping1
Virtualization/Sandbox Evasion		Remote Services1
Email Collection		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
Registry Run Keys / Startup Folder		1
Virtualization/Sandbox Evasion		LSASS Memory1
Process Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading		1
Process Injection		Security Account Manager2
System Owner/User Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDS3
File and Directory Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets23
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/0%Avira URL Cloudsafe

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exe (copy)0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\BUILDPE\EaseUS-x64\tb\bin\is-FSMH5.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-04TMO.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0V2BJ.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0VKK6.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-19TAL.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-20SLO.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-22GF3.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-24FIA.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-25KT5.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2BM3F.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2BVR2.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2CR4U.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2E41F.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2IPO1.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2IUFE.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3BJOU.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3DHJ8.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3GEFV.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3K905.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3QBU3.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-47EEO.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-48G08.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-49VCE.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4A6QT.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4ACJ3.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4EHV1.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4NOHR.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4OV1T.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4PTPN.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4SO60.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-505CN.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5292O.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-59S61.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5BR6G.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5DOTB.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5IHER.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5T2DR.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6CE3K.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6L87R.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6O9EV.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6RRCF.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6TOS7.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-70AL7.tmp0%ReversingLabs
C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-70GJM.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
about:blank0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
rtb-csync-use1.smartadserver.com
23.105.14.105
truefalse
    		high
    sync.aralego.com
    		192.96.203.13
    		truefalse
      		high
      measurement-api.us5.vip.prod.criteo.com
      		74.119.117.37
      		truefalse
        		high
        mail.easeus.com
        		8.218.236.152
        		truefalse
          		high
          us-east-eb2.3lift.com
          		35.71.139.29
          		truefalse
            		high
            mobile-gtalk.l.google.com
            		172.217.215.188
            		truefalse
              		high
              live.rezync.com
              		3.162.125.118
              		truefalse
                		high
                d20qwf0wrdtevy.cloudfront.net
                		3.161.188.80
                		truefalse
                  		high
                  1376624012.rsc.cdn77.org
                  		89.187.167.8
                  		truefalse
                    		unknown
                    stats.g.doubleclick.net
                    		74.125.136.156
                    		truefalse
                      		high
                      cdn.w55c.net
                      		54.145.239.252
                      		truefalse
                        		high
                        csm.us5.vip.prod.criteo.net
                        		74.119.117.24
                        		truefalse
                          		high
                          dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com
                          		54.224.27.195
                          		truefalse
                            		high
                            r.casalemedia.com
                            		104.18.36.155
                            		truefalse
                              		high
                              visitor-us-west-2.omnitagjs.com
                              		44.241.202.18
                              		truefalse
                                		high
                                na-ice.360yield.com
                                		44.213.22.60
                                		truefalse
                                  		high
                                  cm.g.doubleclick.net
                                  		173.194.219.154
                                  		truefalse
                                    		high
                                    pug-vac.pubmnet.com
                                    		8.28.7.83
                                    		truefalse
                                      		unknown
                                      idaas-ext.cph.liveintent.com
                                      		3.227.178.58
                                      		truefalse
                                        		high
                                        ds-pr-bh.ybp.gysm.yahoodns.net
                                        		44.206.160.179
                                        		truefalse
                                          		unknown
                                          www.google.com
                                          		142.250.105.106
                                          		truefalse
                                            		high
                                            syncelb-240036109.us-east-1.elb.amazonaws.com
                                            		34.231.116.157
                                            		truefalse
                                              		high
                                              static.us5.vip.prod.criteo.net
                                              		74.119.117.4
                                              		truefalse
                                                		high
                                                match.adsrvr.org
                                                		15.197.193.217
                                                		truefalse
                                                  		high
                                                  star-mini.c10r.facebook.com
                                                  		31.13.65.36
                                                  		truefalse
                                                    		high
                                                    android.l.google.com
                                                    		108.177.122.101
                                                    		truefalse
                                                      		high
                                                      match.prod.bidr.io
                                                      		54.152.125.5
                                                      		truefalse
                                                        		unknown
                                                        gum.us5.vip.prod.criteo.com
                                                        		74.119.117.17
                                                        		truefalse
                                                          		high
                                                          chidc2.outbrain.org
                                                          		64.74.236.159
                                                          		truefalse
                                                            		unknown
                                                            nydc1.outbrain.org
                                                            		64.202.112.63
                                                            		truefalse
                                                              		unknown
                                                              rtg.prdredir.com
                                                              		104.26.6.114
                                                              		truefalse
                                                                		unknown
                                                                trends.revcontent.com
                                                                		44.196.64.150
                                                                		truefalse
                                                                  		high
                                                                  db7wz9u6tfe6a.cloudfront.net
                                                                  		3.161.193.35
                                                                  		truefalse
                                                                    		high
                                                                    rtb-csync-usw1.smartadserver.com
                                                                    		23.83.76.105
                                                                    		truefalse
                                                                      		high
                                                                      googleads.g.doubleclick.net
                                                                      		142.250.105.156
                                                                      		truefalse
                                                                        		high
                                                                        td.doubleclick.net
                                                                        		173.194.219.156
                                                                        		truefalse
                                                                          		high
                                                                          match-us-east-1-ecs.sharethrough.com
                                                                          		3.226.40.12
                                                                          		truefalse
                                                                            		high
                                                                            partners-alb-1113315349.us-east-1.elb.amazonaws.com
                                                                            		52.23.126.120
                                                                            		truefalse
                                                                              		high
                                                                              widget.us5.vip.prod.criteo.com
                                                                              		74.119.117.16
                                                                              		truefalse
                                                                                		high
                                                                                user-data-us-east.bidswitch.net
                                                                                		35.211.178.172
                                                                                		truefalse
                                                                                  		unknown
                                                                                  mc.yandex.ru
                                                                                  		87.250.250.119
                                                                                  		truefalse
                                                                                    		high
                                                                                    pixel-origin.mathtag.com
                                                                                    		74.121.140.211
                                                                                    		truefalse
                                                                                      		high
                                                                                      hb.yahoo.net
                                                                                      		104.91.175.161
                                                                                      		truefalse
                                                                                        		high
                                                                                        adgcp.tpmn.co.kr
                                                                                        		34.102.166.132
                                                                                        		truefalse
                                                                                          		unknown
                                                                                          e1.emxdgt.com
                                                                                          		3.210.56.21
                                                                                          		truefalse
                                                                                            		unknown
                                                                                            dynamic.us5.vip.prod.criteo.com
                                                                                            		74.119.117.10
                                                                                            		truefalse
                                                                                              		high
                                                                                              us-vip001.taboola.com
                                                                                              		141.226.224.48
                                                                                              		truefalse
                                                                                                		high
                                                                                                gum.da1.vip.prod.criteo.com
                                                                                                		74.119.118.149
                                                                                                		truefalse
                                                                                                  		high
                                                                                                  fledge.us5.vip.prod.criteo.com
                                                                                                  		74.119.117.20
                                                                                                  		truefalse
                                                                                                    		high
                                                                                                    ch-vip001.taboola.com
                                                                                                    		141.226.124.48
                                                                                                    		truefalse
                                                                                                      		high
                                                                                                      contextual.media.net
                                                                                                      		23.45.148.30
                                                                                                      		truefalse
                                                                                                        		high
                                                                                                        scontent.xx.fbcdn.net
                                                                                                        		31.13.88.13
                                                                                                        		truefalse
                                                                                                          		high
                                                                                                          idsync.rlcdn.com
                                                                                                          		35.244.154.8
                                                                                                          		truefalse
                                                                                                            		high
                                                                                                            tapestry.tapad.com
                                                                                                            		34.111.113.62
                                                                                                            		truefalse
                                                                                                              		high
                                                                                                              d1kp3984eicvmo.cloudfront.net
                                                                                                              		54.230.253.37
                                                                                                              		truefalse
                                                                                                                		high
                                                                                                                ad.tpmn.io
                                                                                                                		34.102.166.132
                                                                                                                		truefalse
                                                                                                                  		unknown
                                                                                                                  exchange.mediavine.com
                                                                                                                  		3.223.118.246
                                                                                                                  		truefalse
                                                                                                                    		high
                                                                                                                    part-0013.t-0009.t-msedge.net
                                                                                                                    		13.107.246.41
                                                                                                                    		truefalse
                                                                                                                      		unknown
                                                                                                                      s.ad.smaato.net
                                                                                                                      		3.163.80.21
                                                                                                                      		truefalse
                                                                                                                        		high
                                                                                                                        analytics.google.com
                                                                                                                        		64.233.185.101
                                                                                                                        		truefalse
                                                                                                                          		high
                                                                                                                          b.delivery.consentmanager.net
                                                                                                                          		87.230.98.78
                                                                                                                          		truefalse
                                                                                                                            		unknown
                                                                                                                            widget.trustpilot.com
                                                                                                                            		13.225.214.116
                                                                                                                            		truefalse
                                                                                                                              		high
                                                                                                                              ib.anycast.adnxs.com
                                                                                                                              		68.67.160.117
                                                                                                                              		truefalse
                                                                                                                                		high
                                                                                                                                scripts.prdredir.com
                                                                                                                                		104.26.7.114
                                                                                                                                		truefalse
                                                                                                                                  		unknown
                                                                                                                                  pm.w55c.net
                                                                                                                                  		unknown
                                                                                                                                  		unknownfalse
                                                                                                                                    		high
                                                                                                                                    ads.stickyadstv.com
                                                                                                                                    		unknown
                                                                                                                                    		unknownfalse
                                                                                                                                      		unknown
                                                                                                                                      dynamic.criteo.com
                                                                                                                                      		unknown
                                                                                                                                      		unknownfalse
                                                                                                                                        		high
                                                                                                                                        ad.tpmn.co.kr
                                                                                                                                        		unknown
                                                                                                                                        		unknownfalse
                                                                                                                                          		unknown
                                                                                                                                          jadserve.postrelease.com
                                                                                                                                          		unknown
                                                                                                                                          		unknownfalse
                                                                                                                                            		high
                                                                                                                                            sslwidget.criteo.com
                                                                                                                                            		unknown
                                                                                                                                            		unknownfalse
                                                                                                                                              		high
                                                                                                                                              n.clarity.ms
                                                                                                                                              		unknown
                                                                                                                                              		unknownfalse
                                                                                                                                                		unknown
                                                                                                                                                csm.us5.us.criteo.net
                                                                                                                                                		unknown
                                                                                                                                                		unknownfalse
                                                                                                                                                  		high
                                                                                                                                                  dis.criteo.com
                                                                                                                                                  		unknown
                                                                                                                                                  		unknownfalse
                                                                                                                                                    		high
                                                                                                                                                    c.clarity.ms
                                                                                                                                                    		unknown
                                                                                                                                                    		unknownfalse
                                                                                                                                                      		unknown
                                                                                                                                                      static.criteo.net
                                                                                                                                                      		unknown
                                                                                                                                                      		unknownfalse
                                                                                                                                                        		high
                                                                                                                                                        measurement-api.criteo.com
                                                                                                                                                        		unknown
                                                                                                                                                        		unknownfalse
                                                                                                                                                          		high
                                                                                                                                                          mc.yandex.com
                                                                                                                                                          		unknown
                                                                                                                                                          		unknownfalse
                                                                                                                                                            		high
                                                                                                                                                            pixel.rubiconproject.com
                                                                                                                                                            		unknown
                                                                                                                                                            		unknownfalse
                                                                                                                                                              		high
                                                                                                                                                              connect.facebook.net
                                                                                                                                                              		unknown
                                                                                                                                                              		unknownfalse
                                                                                                                                                                		high
                                                                                                                                                                accounts.livechatinc.com
                                                                                                                                                                		unknown
                                                                                                                                                                		unknownfalse
                                                                                                                                                                  		high
                                                                                                                                                                  1f2e7.v.fwmrm.net
                                                                                                                                                                  		unknown
                                                                                                                                                                  		unknownfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    simage2.pubmatic.com
                                                                                                                                                                    		unknown
                                                                                                                                                                    		unknownfalse
                                                                                                                                                                      		high
                                                                                                                                                                      sync.mathtag.com
                                                                                                                                                                      		unknown
                                                                                                                                                                      		unknownfalse
                                                                                                                                                                        		high
                                                                                                                                                                        sync-criteo.ads.yieldmo.com
                                                                                                                                                                        		unknown
                                                                                                                                                                        		unknownfalse
                                                                                                                                                                          		high
                                                                                                                                                                          p.rfihub.com
                                                                                                                                                                          		unknown
                                                                                                                                                                          		unknownfalse
                                                                                                                                                                            		high
                                                                                                                                                                            down.easeus.com
                                                                                                                                                                            		unknown
                                                                                                                                                                            		unknownfalse
                                                                                                                                                                              		high
                                                                                                                                                                              secure.livechatinc.com
                                                                                                                                                                              		unknown
                                                                                                                                                                              		unknownfalse
                                                                                                                                                                                		high
                                                                                                                                                                                match.sharethrough.com
                                                                                                                                                                                		unknown
                                                                                                                                                                                		unknownfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  criteo-partners.tremorhub.com
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  		unknownfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    criteo-sync.teads.tv
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    		unknownfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      gum.criteo.com
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      		unknownfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        rtb-csync.smartadserver.com
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        		unknownfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          ad.360yield.com
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          		unknownfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            sync.outbrain.com
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            		unknownfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              dpm.demdex.net
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              		unknownfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                aa.agkn.com
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                		unknownfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  visitor.omnitagjs.com
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  		unknownfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    pr-bh.ybp.yahoo.com
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    		unknownfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      x.bidswitch.net
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      		unknownfalse
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        www.facebook.com
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        		unknownfalse
                                                                                                                                                                                                          		high

                                                                                                                                                                                                          Contacted URLs

                                                                                                                                                                                                          NameMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                          https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/false
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            https://static.criteo.net/empty.htmlfalse
                                                                                                                                                                                                              		high
                                                                                                                                                                                                              https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1598135840false
                                                                                                                                                                                                                		high
                                                                                                                                                                                                                https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=150px&styleWidth=100%25&theme=darkfalse
                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                  https://www.easeus.com/backup-software/false
                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                    https://cdn.consentmanager.net/delivery/crossdomain.htmlfalse
                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                      https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=800478534false
                                                                                                                                                                                                                        		high
                                                                                                                                                                                                                        https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag#{%22bundle%22:{%22origin%22:3,%22value%22:%22WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q%22},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}false
                                                                                                                                                                                                                          		high
                                                                                                                                                                                                                          https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d#locale=en-US&styleHeight=500px&styleWidth=100%25&theme=light&sku=720101&name=Todo%20Backup&reviewLanguages=en&noReviews=hidefalse
                                                                                                                                                                                                                            		high
                                                                                                                                                                                                                            https://mc.yandex.com/metrika/metrika_match.htmlfalse
                                                                                                                                                                                                                              		high
                                                                                                                                                                                                                              https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag&us_privacy=1---#{%22bundle%22:{%22origin%22:0,%22value%22:null},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22easeus.com%22,%22topUrl%22:%22www.easeus.com%22,%22version%22:%225_23_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}false
                                                                                                                                                                                                                                		high
                                                                                                                                                                                                                                https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0false
                                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                                  about:blankfalse
                                                                                                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                                                                                                  		low

                                                                                                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                                                                                                  Public IPs

                                                                                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                                  172.217.215.188
                                                                                                                                                                                                                                  		mobile-gtalk.l.google.comUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  13.107.246.41
                                                                                                                                                                                                                                  		part-0013.t-0009.t-msedge.netUnited States
                                                                                                                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                  54.230.253.37
                                                                                                                                                                                                                                  		d1kp3984eicvmo.cloudfront.netUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  3.161.193.35
                                                                                                                                                                                                                                  		db7wz9u6tfe6a.cloudfront.netUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  18.244.202.53
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  87.250.250.119
                                                                                                                                                                                                                                  		mc.yandex.ruRussian Federation
                                                                                                                                                                                                                                  		13238YANDEXRUfalse
                                                                                                                                                                                                                                  35.244.154.8
                                                                                                                                                                                                                                  		idsync.rlcdn.comUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  173.194.219.156
                                                                                                                                                                                                                                  		td.doubleclick.netUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  142.250.105.138
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  3.161.188.80
                                                                                                                                                                                                                                  		d20qwf0wrdtevy.cloudfront.netUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  172.253.124.147
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  173.194.219.154
                                                                                                                                                                                                                                  		cm.g.doubleclick.netUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  173.194.219.95
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  87.230.98.78
                                                                                                                                                                                                                                  		b.delivery.consentmanager.netGermany
                                                                                                                                                                                                                                  		61157PLUSSERVER-ASN1DEfalse
                                                                                                                                                                                                                                  104.18.6.90
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                  20.110.205.119
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                  23.12.145.137
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                                                                                                                  31.13.88.13
                                                                                                                                                                                                                                  		scontent.xx.fbcdn.netIreland
                                                                                                                                                                                                                                  		32934FACEBOOKUSfalse
                                                                                                                                                                                                                                  74.119.117.10
                                                                                                                                                                                                                                  		dynamic.us5.vip.prod.criteo.comUnited States
                                                                                                                                                                                                                                  		19750AS-CRITEOUSfalse
                                                                                                                                                                                                                                  74.125.138.95
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  157.185.177.217
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		54994QUANTILNETWORKSUSfalse
                                                                                                                                                                                                                                  13.225.214.116
                                                                                                                                                                                                                                  		widget.trustpilot.comUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  3.227.178.58
                                                                                                                                                                                                                                  		idaas-ext.cph.liveintent.comUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  204.79.197.237
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                  18.64.155.56
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                                                  1.1.1.1
                                                                                                                                                                                                                                  		unknownAustralia
                                                                                                                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                  64.233.177.97
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  104.112.235.114
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                                                                                                                  3.161.188.78
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  239.255.255.250
                                                                                                                                                                                                                                  		unknownReserved
                                                                                                                                                                                                                                  		unknownunknownfalse
                                                                                                                                                                                                                                  77.88.21.119
                                                                                                                                                                                                                                  		unknownRussian Federation
                                                                                                                                                                                                                                  		13238YANDEXRUfalse
                                                                                                                                                                                                                                  142.250.9.84
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  108.177.122.101
                                                                                                                                                                                                                                  		android.l.google.comUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  104.26.6.114
                                                                                                                                                                                                                                  		rtg.prdredir.comUnited States
                                                                                                                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                  108.177.122.95
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  142.251.15.157
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  68.67.160.132
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		29990ASN-APPNEXUSfalse
                                                                                                                                                                                                                                  54.224.27.195
                                                                                                                                                                                                                                  		dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.comUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  198.8.71.131
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		54312ROCKETFUELUSfalse
                                                                                                                                                                                                                                  23.221.212.214
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		35994AKAMAI-ASUSfalse
                                                                                                                                                                                                                                  142.250.105.156
                                                                                                                                                                                                                                  		googleads.g.doubleclick.netUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  34.239.2.224
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  173.194.219.138
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  63.251.28.234
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		26558FREEWHEELUSfalse
                                                                                                                                                                                                                                  8.43.72.98
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		26667RUBICONPROJECTUSfalse
                                                                                                                                                                                                                                  63.251.28.233
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		26558FREEWHEELUSfalse
                                                                                                                                                                                                                                  8.43.72.97
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		26667RUBICONPROJECTUSfalse
                                                                                                                                                                                                                                  216.200.232.253
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		30419MEDIAMATH-INCUSfalse
                                                                                                                                                                                                                                  23.48.203.207
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		24319AKAMAI-TYO-APAkamaiTechnologiesTokyoASNSGfalse
                                                                                                                                                                                                                                  3.163.80.21
                                                                                                                                                                                                                                  		s.ad.smaato.netUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  64.74.236.159
                                                                                                                                                                                                                                  		chidc2.outbrain.orgUnited States
                                                                                                                                                                                                                                  		22075AS-OUTBRAINUSfalse
                                                                                                                                                                                                                                  52.184.204.244
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                  3.162.125.118
                                                                                                                                                                                                                                  		live.rezync.comUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  44.196.64.150
                                                                                                                                                                                                                                  		trends.revcontent.comUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  142.250.9.139
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  54.152.125.5
                                                                                                                                                                                                                                  		match.prod.bidr.ioUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  195.181.164.14
                                                                                                                                                                                                                                  		unknownUnited Kingdom
                                                                                                                                                                                                                                  		60068CDN77GBfalse
                                                                                                                                                                                                                                  23.50.228.222
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                                                  64.233.185.94
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  44.212.89.30
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  64.202.112.63
                                                                                                                                                                                                                                  		nydc1.outbrain.orgUnited States
                                                                                                                                                                                                                                  		22075AS-OUTBRAINUSfalse
                                                                                                                                                                                                                                  34.231.116.157
                                                                                                                                                                                                                                  		syncelb-240036109.us-east-1.elb.amazonaws.comUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  54.70.167.86
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  23.48.203.199
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		24319AKAMAI-TYO-APAkamaiTechnologiesTokyoASNSGfalse
                                                                                                                                                                                                                                  3.211.252.87
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  34.226.174.113
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  35.211.178.172
                                                                                                                                                                                                                                  		user-data-us-east.bidswitch.netUnited States
                                                                                                                                                                                                                                  		19527GOOGLE-2USfalse
                                                                                                                                                                                                                                  8.28.7.83
                                                                                                                                                                                                                                  		pug-vac.pubmnet.comUnited States
                                                                                                                                                                                                                                  		62713AS-PUBMATICUSfalse
                                                                                                                                                                                                                                  142.251.15.95
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  74.125.136.147
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  192.96.203.13
                                                                                                                                                                                                                                  		sync.aralego.comUnited States
                                                                                                                                                                                                                                  		30633LEASEWEB-USA-WDCUSfalse
                                                                                                                                                                                                                                  8.218.236.152
                                                                                                                                                                                                                                  		mail.easeus.comSingapore
                                                                                                                                                                                                                                  		45102CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdCfalse
                                                                                                                                                                                                                                  141.226.124.48
                                                                                                                                                                                                                                  		ch-vip001.taboola.comIsrael
                                                                                                                                                                                                                                  		200478TABOOLA-ASILfalse
                                                                                                                                                                                                                                  13.107.21.237
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                  23.222.197.151
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                                                  74.119.117.37
                                                                                                                                                                                                                                  		measurement-api.us5.vip.prod.criteo.comUnited States
                                                                                                                                                                                                                                  		19750AS-CRITEOUSfalse
                                                                                                                                                                                                                                  23.12.147.92
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                                                                                                                  74.119.118.149
                                                                                                                                                                                                                                  		gum.da1.vip.prod.criteo.comUnited States
                                                                                                                                                                                                                                  		19750AS-CRITEOUSfalse
                                                                                                                                                                                                                                  23.23.223.78
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  104.18.36.155
                                                                                                                                                                                                                                  		r.casalemedia.comUnited States
                                                                                                                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                  23.53.35.106
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                                                                                                                  44.206.160.179
                                                                                                                                                                                                                                  		ds-pr-bh.ybp.gysm.yahoodns.netUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  64.233.185.101
                                                                                                                                                                                                                                  		analytics.google.comUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  23.53.35.108
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                                                                                                                  104.26.7.114
                                                                                                                                                                                                                                  		scripts.prdredir.comUnited States
                                                                                                                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                  3.210.56.21
                                                                                                                                                                                                                                  		e1.emxdgt.comUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  54.230.31.12
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                                                  74.125.136.156
                                                                                                                                                                                                                                  		stats.g.doubleclick.netUnited States
                                                                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                                                                  74.119.117.4
                                                                                                                                                                                                                                  		static.us5.vip.prod.criteo.netUnited States
                                                                                                                                                                                                                                  		19750AS-CRITEOUSfalse
                                                                                                                                                                                                                                  31.13.65.36
                                                                                                                                                                                                                                  		star-mini.c10r.facebook.comIreland
                                                                                                                                                                                                                                  		32934FACEBOOKUSfalse
                                                                                                                                                                                                                                  89.187.167.8
                                                                                                                                                                                                                                  		1376624012.rsc.cdn77.orgCzech Republic
                                                                                                                                                                                                                                  		60068CDN77GBfalse
                                                                                                                                                                                                                                  44.213.22.60
                                                                                                                                                                                                                                  		na-ice.360yield.comUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  23.12.147.81
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		20940AKAMAI-ASN1EUfalse
                                                                                                                                                                                                                                  172.64.151.101
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                  15.197.193.217
                                                                                                                                                                                                                                  		match.adsrvr.orgUnited States
                                                                                                                                                                                                                                  		7430TANDEMUSfalse
                                                                                                                                                                                                                                  47.252.97.212
                                                                                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                                                                                  		45102CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdCfalse
                                                                                                                                                                                                                                  3.223.118.246
                                                                                                                                                                                                                                  		exchange.mediavine.comUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                  54.145.239.252
                                                                                                                                                                                                                                  		cdn.w55c.netUnited States
                                                                                                                                                                                                                                  		14618AMAZON-AESUSfalse

                                                                                                                                                                                                                                  Private

                                                                                                                                                                                                                                  IP
                                                                                                                                                                                                                                  192.168.2.16
                                                                                                                                                                                                                                  127.0.0.1

                                                                                                                                                                                                                                  General Information

                                                                                                                                                                                                                                  Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                                                                  Analysis ID:1430567
                                                                                                                                                                                                                                  Start date and time:2024-04-23 22:05:31 +02:00
                                                                                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                                  Overall analysis duration:
                                                                                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                                  Report type:full
                                                                                                                                                                                                                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                                                                                                                                                  Sample URL:https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/
                                                                                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                                  Number of analysed new started processes analysed:29
                                                                                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                                                                                                  Technologies:
                                                                                                                                                                                                                                  • EGA enabled
                                                                                                                                                                                                                                  Analysis Mode:stream
                                                                                                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                                                                                                  Detection:CLEAN
                                                                                                                                                                                                                                  Classification:clean8.win@54/606@273/712

                                                                                                                                                                                                                                  Warnings

                                                                                                                                                                                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
                                                                                                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 142.250.9.94, 142.250.9.84, 142.250.105.138, 142.250.105.101, 142.250.105.113, 142.250.105.139, 142.250.105.102, 142.250.105.100, 104.18.6.90, 104.18.7.90, 34.104.35.123, 64.233.177.97, 108.177.122.95, 64.233.177.95, 142.250.9.95, 64.233.176.95, 142.251.15.95, 74.125.138.95, 173.194.219.95, 172.253.124.95, 142.250.105.95, 172.217.215.95, 64.233.185.95, 108.177.122.101, 108.177.122.102, 108.177.122.138, 108.177.122.139, 108.177.122.113, 108.177.122.100, 172.217.215.157, 172.217.215.156, 172.217.215.155, 172.217.215.154, 204.79.197.237, 13.107.21.237, 20.110.205.119, 52.184.204.244
                                                                                                                                                                                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, bat-bing-com.dual-a-0034.a-msedge.net, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, clientservices.googleapis.com, www.easeus.com.cdn.cloudflare.net, pagead2.googlesyndication.com, vmss-clarity-ingest-eus2-f.eastus2.cloudapp.azure.com, clients2.google.com, edgedl.me.gvt1.com, www.googletagmanager.com, c.bing.com, bat.bing.com, dual-a-0034.a-msedge.net, azurefd-t-prod.trafficmanager.net, clients.l.google.com, www.google-analytics.com
                                                                                                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                                  • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                                                  • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                                                                  • Timeout during stream target processing, analysis might miss dynamic analysis data
                                                                                                                                                                                                                                  • VT rate limit hit for: https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/

                                                                                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\BUILDPE\EaseUS-x64\tb\bin\TBFVSS.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:28449DD3E748DACF927B000248F3437E
                                                                                                                                                                                                                                  SHA1:44F0A41926ECD77A8C3FC4D54883119B56501F7C
                                                                                                                                                                                                                                  SHA-256:1A13B43B63A674321E1CA5DA565630D4CCAAFA2E8523FD736AEBDD7349588458
                                                                                                                                                                                                                                  SHA-512:B88356D99CB235DC69D28CB626EBDF3980C01A30C4C1C2C2384351B690EDDDF69A149A9BD59AC4E8359D3765D157F9E0F05EE1D7F03E143D98143A7205EB438E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.8.].k.].k.].k.%kk.].k.%zk.].k.%}k.].k.%mk.].k...k.].k.].k.].k.%tk.].k.%lk.].k..jk.].k.%ok.].kRich.].k........................PE..d...O..e.........." .....,................................................... ............@.........................................0.......p...d...............l........*......0...@C...............................................@...............................text...z*.......,.................. ..`.rdata...^...@...`...0..............@..@.data... 7..........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\BUILDPE\EaseUS-x64\tb\bin\is-FSMH5.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):127496
                                                                                                                                                                                                                                  Entropy (8bit):6.222947382111064
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:28449DD3E748DACF927B000248F3437E
                                                                                                                                                                                                                                  SHA1:44F0A41926ECD77A8C3FC4D54883119B56501F7C
                                                                                                                                                                                                                                  SHA-256:1A13B43B63A674321E1CA5DA565630D4CCAAFA2E8523FD736AEBDD7349588458
                                                                                                                                                                                                                                  SHA-512:B88356D99CB235DC69D28CB626EBDF3980C01A30C4C1C2C2384351B690EDDDF69A149A9BD59AC4E8359D3765D157F9E0F05EE1D7F03E143D98143A7205EB438E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.8.].k.].k.].k.%kk.].k.%zk.].k.%}k.].k.%mk.].k...k.].k.].k.].k.%tk.].k.%lk.].k..jk.].k.%ok.].kRich.].k........................PE..d...O..e.........." .....,................................................... ............@.........................................0.......p...d...............l........*......0...@C...............................................@...............................text...z*.......,.................. ..`.rdata...^...@...`...0..............@..@.data... 7..........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\7za.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8ACDBFC9777A604CFECA10F656C0AAEF
                                                                                                                                                                                                                                  SHA1:58B1C08912FB2F1388C69AC747D895D1006A73D3
                                                                                                                                                                                                                                  SHA-256:47FFBE04A61C9011BADD7716AC7B3636C21EB6D0CED549607224779339764147
                                                                                                                                                                                                                                  SHA-512:21C955BA6AA543B0419256DCBB4D2B42376DC361F2FDC475B1E2D907BED006F31A1D8C06C044412B33330BC4A330B44610A3DB908182D75A69275D7BA498FD50
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.].h.3.h.3.h.3...?.j.3..=.r.3.^.9.3.3..l.i.3.h.2..3..n.o.3.^.8..3....H.3....j.3..5.i.3.Richh.3.........................PE..L.....M........../..........f......T.............@............................................................................P.......................................................................................8............................text.............................. ..`.rdata..............................@..@.data............h..................@....sxdata.............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AccountManager.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3B009DBB38F092D0337C817007A074DA
                                                                                                                                                                                                                                  SHA1:AD705E146B66126860577BB001D00BDC8601970E
                                                                                                                                                                                                                                  SHA-256:18D6F8AB7E42CCA24D7B553973374B24B18CE0F6FE9588EC8CE42EFA845D03C3
                                                                                                                                                                                                                                  SHA-512:4E199B8A64C9B8A035706E45917316F0A7D6317192007C7839147E15A8B371DDCBDD99FA0F842D696BEF784F4315344103727AEA53E071FD7663872853FF33F3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................n.......x...............h...............q.......i.......j.....Rich............PE..L......e...........!.....(... .......1.......@.......................................7....@..........................Q..c....J..x....p...............L...*..........@A...............................H..@............@..,............................text...1'.......(.................. ..`.rdata.......@.......,..............@..@.data...p....`.......B..............@....rsrc........p.......D..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActivationOnline.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:25564BA861216215698E0746DD5D8CFA
                                                                                                                                                                                                                                  SHA1:6C1CE8697057C364F618ECC06592E8C0743ADC90
                                                                                                                                                                                                                                  SHA-256:40735C54F545E2CB80BD642B86CC0F83BE9D3803237BF6789E921F00B57393D3
                                                                                                                                                                                                                                  SHA-512:E5D820AAB94DDB8F9DE327DDA835074DFD6A7E8E500D28ECB6576D2D62847093C40876BFD8A92F1A0EE56A8AEF9E475CE5C5AC8C923385AD8AD7DCDDD18ECB28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........J..J..J......K..C.-.M..C.;.E..C.<.C..C.+.E..J.....C.2.M..C.*.K..C.).K..RichJ..................PE..L...z..e...........!.........T...............................................`......dB....@.........................`*...............@...............6...*...P......@...................................@...............$............................text............................... ..`.rdata...:.......<..................@..@.data........0......................@....rsrc........@.......$..............@..@.reloc.......P.......(..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActiveOnline.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4A77BDD49B717B97CA014799B548858D
                                                                                                                                                                                                                                  SHA1:6544471550220AC8D6ABD3C4506EA3F60389CF1C
                                                                                                                                                                                                                                  SHA-256:CEC1F39A9C9208779E8BABB3174A464068ABD19F890AC4FAC56110008E18F799
                                                                                                                                                                                                                                  SHA-512:36E32F95EB17BFB44DE3A5031F293132610ED49968A649D056D13A58DCDDB0F9B16BF37C8D1C01CFDDCE6548BFEFB8B1D008D561D97EDE4495DF5102B9CA8D9F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.|.V{/.V{/.V{/.../.V{/.../.V{/.../.V{/.../.V{/.../.V{/.Vz/.V{/.../.V{/.../.V{/.../.V{/Rich.V{/................PE..L...{..e...........!.................".......0...............................p............@..........................>..k...d9..P....P...............8...*...`..0....1...............................4..@............0...............................text............................... ..`.rdata.......0......................@..@.data...0....@......................@....rsrc........P.......0..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActiveTrans.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2513877799018706CD1106A0F19B1304
                                                                                                                                                                                                                                  SHA1:0D6CF30E615A46594AEEDBCB66AAD8921D002F4B
                                                                                                                                                                                                                                  SHA-256:9985D27A2E61502B7893B9614773FCCBF5607E86311CB2E474414607E442ED82
                                                                                                                                                                                                                                  SHA-512:B6B26B43DEAACC004451AAEC8E9A5E67DE137F0A9744B96668BA62605F3F88C256D86C191FEBB46ECF9050ABE0718C804039AB3D33C3D1C270C2A4CA7F905521
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................c.....`.....v.....q.....f.................d....Rich............PE..L...{..e............................[#.......0....@..........................p......F.....@..................................5..d....P...............4...*...`..<....1..............................P4..@............0...............................text............................... ..`.rdata..,....0......................@..@.data...4....@.......*..............@....rsrc........P.......,..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AdvertisingPopup.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:68031243D885BD56976B0539B9A100FD
                                                                                                                                                                                                                                  SHA1:84BEB4ECD145FC98597FC640E474BA53035662FB
                                                                                                                                                                                                                                  SHA-256:376FC2083360E56DBB35C02086125621F112F2812E635D15686357DD9EB3F960
                                                                                                                                                                                                                                  SHA-512:1488727963B254CB5111896E6B9787E9460A8110BBBD6B8E78253D7289AAAE4CDE9452DAC9C1920C7547A2D4140C1EBDDDCB2934689B2BDDF33550C372F8B970
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!D..rD..rD..r...sH..r...sF..r...sX..r...s@..r+..sB..rM.ErJ..r..sF..r..sM..rD..r...r..sB..r.)rE..rD.ArE..r..sE..rRichD..r................PE..L..._..e..........................................@.................................WB....@..................................I..h.......@............b...*..............8...............................@............@...............................text............................... ..`.rdata..[A.......B..................@..@.data........0......................@....idata...H...@...J..................@..@.tls.................\..............@....00cfg...............`..............@..@.rsrc...@............b..............@..@.reloc..,............P..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E1CEDAAFBE2F1BBBEEC8B2F83528BD97
                                                                                                                                                                                                                                  SHA1:C09EF179EF42C88B39A881EB8D26619A46F4E4BF
                                                                                                                                                                                                                                  SHA-256:868F284E5E41FC8A43E596880097CF82D22F0FE667EF17284BC4A41CD04DB5DF
                                                                                                                                                                                                                                  SHA-512:845B510845B36FA5F05AC68EBD59A0A5BE729DE2C2FAEAC81E4881BEFEDCB4368674BCF40FF7DCE698C208B96604F643773753FF59B2080CBD7F61A59F691346
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..|..s/..s/..s/.../..s/.../..s/.../..s/.../..s/.../..s/..r/b.s/.../..s/.../..s/.../..s/.../..s/Rich..s/........................PE..L......e.................@...B.......G.......P....@.......................................@..........................|..b....q...........................*...........Q...............................l..@............P...............................text...L?.......@.................. ..`.rdata..b,...P.......D..............@..@.data...8............r..............@....rsrc................v..............@..@.reloc..v............~..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AliyunConfig.ini (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:643FE6367E0B95C79DE12F7BD0EC7399
                                                                                                                                                                                                                                  SHA1:82F5B0908D33CEC3D4FC3461904AD78149293F37
                                                                                                                                                                                                                                  SHA-256:5FF7D17A6091E6D7FCAC50FC43A5348DF5DA573606A0E3264FC3B8E2C129CDED
                                                                                                                                                                                                                                  SHA-512:1B0920892897C8B2DC36785E44797B4EFCA7942D6659BC8965D7E81282C29795307E02E41207788FC461015DC8D7C1D295EAFD3DF673801F834195E9FF778B99
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......[.C.o.n.f.i.g.].....L.O.G.E.N.D.P.O.I.N.T.=.W.k.Z.o.T.m.R.G.c.F.h.S.b.n.B.r.U.X.p.C.N.F.R.H.M.T.R.k.b.H.A.1.T.l.d.o.a.V.I.y.d.z.F.a.R.m.M.x.Y.W.1.O.N.U.5.X.c.G.l.N.a.k.E.5.....A.C.C.E.S.S.K.E.Y.I.D.=.V.k.V.a.U.1.F.s.T.l.Z.T.a.1.Z.U.U.0.d.S.T.l.V.6.Q.j.B.N.b.U.1.3.W.j.N.o.U.F.V.U.M.D.k.=.....A.C.C.E.S.S.K.E.Y.S.E.C.R.E.T.=.V.1.d.4.T.2.Q.w.O.U.d.a.R.n.B.O.U.k.V.a.T.1.d.q.T.m.9.T.b.E.Z.1.V.G.p.G.U.2.V.r.W.k.t.Z.M.V.J.D.Y.z.A.x.W.G.F.G.T.l.d.h.b.V.J.o.V.1.d.0.T.m.V.R.P.T.0.=.....P.R.O.J.E.C.T.N.A.M.E.=.V.2.x.k.R.2.V.s.c.F.l.W.b.n.B.o.V.n.p.W.d.F.l.u.Y.z.l.Q.U.T.0.9.....L.O.G.S.T.O.R.E.N.A.M.E.=.W.W.t.j.N.W.J.t.T.X.p.V.b.l.p.q.Y.l.Z.a.b.V.p.F.Z.E.t.k.M.W.d.5.Y.k.h.j.P.Q.=.=.....L.O.G.S.T.O.R.E.N.A.M.E.2.=.W.W.t.j.N.W.J.t.T.X.p.V.b.l.p.q.Y.l.Z.a.b.V.p.F.Z.E.t.k.M.W.d.5.T.l.h.a.a.F.d.F.R.T.k.=.....b.A.l.l.o.w.S.e.n.d.I.n.f.o.=.1.....b.A.u.t.o.A.d.d.U.i.d.=.1.....b.A.u.t.o.A.d.d.T.i.m.e.s.t.a.m.p.=.1.....b.G.e.n.e.r.a.t.e.T.e.s.t.I.n.f.o.=.1.....n.b.L.i.m.i.t.K.e.y.v.a.l.u.e.M.a.x.L.e.n.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AliyunWrap.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C57F2B95CFD3D69D4CF89C132F66AE58
                                                                                                                                                                                                                                  SHA1:24F721049467FD1C13A4F9ED88CF0F99E66A858E
                                                                                                                                                                                                                                  SHA-256:CC90C9710E05A7D7E5F01549EBB2A7823DC2790A35DF8D53E150B5F947B92B2D
                                                                                                                                                                                                                                  SHA-512:29FEB73F7FBB6A17F6F69657ECA378B3B6A418F27065F97A69F105621EECBDAB02C6411F1C503962C33FB62A05AC5CA398BA459E41624C05832257F6B5D57BD0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................&.s.....a.....p.....v......P...f.....o.....w.....t....Rich...................PE..L......e...........!.....R...H...............p............................................@..........................R..g...4C...........................*......X8..ps.............................../..@............p..$............................text....Q.......R.................. ..`.rdata..'....p.......V..............@..@.data....E...`.......>..............@....rsrc................T..............@..@.reloc...F.......H...V..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AliyunWrapExe.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5D2B193CC78C786B9C678F7DE6E6C491
                                                                                                                                                                                                                                  SHA1:B895179BA596C752541E684CC0D568B47817D0C6
                                                                                                                                                                                                                                  SHA-256:EF4DB6DA7A1B6238C6BF502C9E9BCCF4E45BCB98ABEFEFE790471435C3EE7D30
                                                                                                                                                                                                                                  SHA-512:8EC789F806BE73E0C3C650FCD621B15CA8B59F2FBE6D73EC6DEFF44D6FB310E4C8D6EBE6B2742D2361F0E826787EFF9B5E43A853DD8777839C75E344BA1BFC22
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uK@.1*..1*..1*..8R..#*..8R..\*..8R...*..8R..>*..1*/.L*..8R.. *..8R..0*..Rich1*..................PE..L......e.................8...t..............P....@.................................)%....@................................. ............................*...........Q...............................z..@............P...............................text...G7.......8.................. ..`.rdata..LC...P...D...<..............@..@.data....-..........................@....rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AndroidFileExtend_default.xml (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:221652D34CB9B7BEE0B5ECBBD1089546
                                                                                                                                                                                                                                  SHA1:D25B9498830507E24F72C7BCE07FBB3EB2A3AF0A
                                                                                                                                                                                                                                  SHA-256:A5D6AAAA12E3AC9E2AF9ADEFF3983923F58665168613964822150F3BA0800D82
                                                                                                                                                                                                                                  SHA-512:7AA66B63164AF314F9F6FB86D0FBEF7A049A5C3629A4391EE6E4EAAE3C8397FBF6596057AF7B063413A8903F66880CD9A885F10A31AD3A8D5662430BCB3ABDE3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<EASEUS>.. <GROUP default="Yes" name="Music" icon="../res/Music.png"> .. <EXTEND default="Yes" name="AAC" icon="../res/iconView/AAC.png" comment=""/>.. <EXTEND default="Yes" name="AC3" icon="../res/iconView/AC3.png" comment=""/>.. <EXTEND default="Yes" name="M4A" icon="../res/iconView/M4A.png" comment=""/>.. <EXTEND default="Yes" name="AMR" icon="../res/iconView/AMR.png" comment=""/>.. <EXTEND default="Yes" name="FLAC" icon="../res/iconView/FLAC.png" comment=""/>.. <EXTEND default="Yes" name="APE" icon="../res/iconView/APE.png" comment=""/>.. <EXTEND default="Yes" name="MP3" icon="../res/iconView/MP3.png" comment=""/>.. <EXTEND default="Yes" name="WMA" icon="../res/iconView/WMA.png" comment=""/>.. <EXTEND default="Yes" name="OGG" icon="../res/iconView/OGG.png" comment=""/>.. <EXTEND default="Yes" name="OGA" icon="../res/iconView/OGA.png" comment=""/>.. <EXTEND default="Yes" name="WAV" icon="../res/iconView/WAV.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AppBackup.cfg (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:11EA6085188129B770C7F2BC1A72567E
                                                                                                                                                                                                                                  SHA1:9C11EDAE37A78AE49A26D0F6F6F62301CBDB796E
                                                                                                                                                                                                                                  SHA-256:7BD18C3EC37B8A9F61806823796CF6AEDD884BC5CA56E54D698D7D0986A5D767
                                                                                                                                                                                                                                  SHA-512:FE5DAE1C80F0799FD283AA61F7CE14D5F3F69E63B4987788EC00BFF321F9E0AA2DE04428BA9F43CE0D87103930C31CB16D9CF12E8ABB95440508C4FE23063B42
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:[Dll]..Microsoft Outlook="OutlookDataBackup.dll"..Chrome="ChromeDataBackup.dll"..Game Save="GameDataBackup.dll"

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AppData.cfg (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:429C02A9D3D161C6CF1BC7C0D7A79E37
                                                                                                                                                                                                                                  SHA1:425ED89D1B52AD95E80A79DA49057D9E78E0282C
                                                                                                                                                                                                                                  SHA-256:537F3A1CB39892D0D355DFE3C8888EEE7704E3FBF3BE642CDE800F8881065AD1
                                                                                                                                                                                                                                  SHA-512:98930CD2ADF8C459157BD39F4B3AB7B4D8C0A3431016C5492A14622B0DA27268BD2143AFB11D533CE9C810FBDB97C45FFD2179114468C87E9B74D9377E88C34E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<Game name="GTA V">...<Configuration Exclude="Profiles">%USERPROFILE%\Documents\Rockstar Games\GTA V</Configuration>...<Configuration Architecture="x64" Exclude="Profiles">%PROGRAMFILES(X86)%\Steam\steamapps\compatdata\271590\pfx</Configuration>...<Configuration Architecture="x86" Exclude="Profiles">%PROGRAMFILES%\Steam\steamapps\compatdata\271590\pfx</Configuration>...<Data>%USERPROFILE%\Documents\Rockstar Games\GTA V\Profiles</Data>...<Data>%PROGRAMDATA%\Socialclub\Player</Data>...<Data Architecture="x64">%PROGRAMFILES(X86)%\Steam\steamapps\compatdata\271590\pfx\Profiles</Data>...<Data Architecture="x86">%PROGRAMFILES%\Steam\steamapps\compatdata\271590\pfx\Profiles</Data>..</Game>..<Game name="COD Modern warfare 2">...<Configuration Include = "config*.cfg|options.*.cst">%USERPROFILE%\Documents\Call of Duty\players</Configuration>...<Configuration Architecture="x64" Include = "config*.cfg|options.*.cst">%PROGRAMFILES(X86)%\Steam\steamapps\compatdata\1938090\pfx</Configuration>...<Conf

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AppSetup.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FB1B129F09AE255837E2DFAE56EC393E
                                                                                                                                                                                                                                  SHA1:AFB7554748173BE8FAE4E76EAED16559202718FD
                                                                                                                                                                                                                                  SHA-256:052F5CD8EEF61D00CF53FB0C112721419BD2F61ADA6CE86982A515B98C1F5AB4
                                                                                                                                                                                                                                  SHA-512:491160890CD05D0B41BA759E63D0A7E3DDD4829FB5E5F796B9BAD07A2B257D5D11216F8E73AAC10E17C9D8C128AB707763558304F84C66B0675FB57EB85FDAA3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.._.._.._...K.._..'H.._..'^.._..'Y.._..'N.._.._.#_..'W.._..'O.._..'L.._.Rich._.................PE..L......e.................p...H.......n............@.......................................@.............................e...P...x........................*..........0...............................@...@............................................text....n.......p.................. ..`.rdata...2.......4...t..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AuConv.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FD306A29934D84ED646E71661F25F4F5
                                                                                                                                                                                                                                  SHA1:E75F51B1738B272AB6D3280501EA68784E99A320
                                                                                                                                                                                                                                  SHA-256:6D4C96D9E2470D814450E196A5788366A99B6F341716C0D06169A9408F395E27
                                                                                                                                                                                                                                  SHA-512:A882F5FB547C03725B3A98A001DD68EC2DF971255D3BAE7116B0D9FAEE010C36C6D656A8C30B3FB05E7B4EF0F180B47905AA767C97D13CE554C415E076EBC7EF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./I7.k(Y.k(Y.k(Y..7].i(Y..4U.j(Y..7J.a(Y..7R.i(Y..4W.h(Y..7S.o(Y..7].o(Y...R.i(Y.k(X..(Y...].h(Y.m.R.}(Y..._.j(Y...].j(Y.Richk(Y.................PE..L...W..H...........!................w........................................`..............................................h........@..8....................P..H.......................................................|............................text............................... ..`.rdata..>O.......P..................@..@.data...(.... ....... ..............@....rsrc...8....@....... ..............@..@.reloc.......P.......0..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AuConvEx.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E66211F9DD062CB43A8543A8E0E845D1
                                                                                                                                                                                                                                  SHA1:6F62412303DDC9132F67B549ED1E8C4FE3142B40
                                                                                                                                                                                                                                  SHA-256:1960ACB6F59DA5FB8BE25FEEC0E1B9736D7EAD75B0F57D772025806046D198C7
                                                                                                                                                                                                                                  SHA-512:E8FCEB24C7C32AE553A5F4942F3EEA33B51CFC7F7378027578D37483B2887EDC0D98F2B29B1EFE379BA52A2DEDF92E1D9D9D1A1BBFF408FF34D393872B53AD5B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.. .. .. ..[.."..B.."..O..".....#..O..$..O.."..Y..".. .....Y..#..&..3.....!....#..Rich ..................PE..L......K...........!.........0..........................................................................................F.......d.......H.......................(....................................................................................text...U........................... ..`.rdata..F...........................@..@.data...$...........................@....rsrc...H............@..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AuthorizedMng.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FCBF245572EFBDB1E7125A7460717176
                                                                                                                                                                                                                                  SHA1:175BF63842E85637B53885811F767FF47B97621A
                                                                                                                                                                                                                                  SHA-256:580528ECD821F62A2BCDF7DB4C765FCB0A463F8DCF3F6BDF799AFBC423277C14
                                                                                                                                                                                                                                  SHA-512:BE602A22461427DD34742A116E85D7A0D73A2C315193E1321DE7E7BA957FE96A51E250C739B610F2333DAFE9BB467EA437BB5BDAFA793F07236F8D77D743C919
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i..s&...i.......i.......i.......i.......i...i..yi.......i.......i.......i..Rich.i..................PE..L...x..e...........!................................................................K.....@.........................`q..4...\N..x........................*......`....................................#..@............................................text...O........................... ..`.rdata...p.......r..................@..@.data................r..............@....rsrc................t..............@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AutoLoader.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DB48C9472F3CD5F44624733D75D69CD2
                                                                                                                                                                                                                                  SHA1:CAB150E375C085F4E713A25024DC35F1CD3757EE
                                                                                                                                                                                                                                  SHA-256:08AFD687B136542DD284DB80947DD5E4E79F80CB7177DC0B99B261335CC8A730
                                                                                                                                                                                                                                  SHA-512:D1B1FECA151E32E94F5F694726094D81BB50C6691DA79B1A583D7EE9AAB2D994AC048028FCE029607531C2788821BA332A08C6B3CDE02A453A26B5CAD4B222AA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)[|.H5/.H5/.H5/'../.H5/.0./.H5/.0./.H5/.../.H5/.0./.H5/.0./.H5/.H4/.H5/.0./.H5/.0./.H5/.0./.H5/Rich.H5/........PE..L......e...........!.....h...6.......j....................................................@.........................0...........x........................*......d...................................p...@............................................text...{f.......h.................. ..`.rdata...#.......$...l..............@..@.data...............................@....rsrc...............................@..@.reloc..f...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AutoLoaderApp.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BA3EAEB4D316D84A6BE44BEBC712A0DE
                                                                                                                                                                                                                                  SHA1:0202A5369101D47C39B5F0C8D1FF91BE660C16A8
                                                                                                                                                                                                                                  SHA-256:6E555E3E07A5D96D0140DF2E46D279ABD0F0A91C74D5482EE8E2B55AC26C5250
                                                                                                                                                                                                                                  SHA-512:0FB8630C908840000984C0A1BA53117E4DD7972A8119E8E80C01EF81957355A83B9D18B3EFC26F420004C7AA6F25A7C0FDEB935D1F4686583854E4793E17A60A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A...A...A...H.o.@...H.y.T...H.~.B...H.i.H...A.......H.p.C...H.k.@...RichA...................PE..L......e.....................................0....@..........................p.......$....@..................................5..d....P...............0...*...`......`1..............................03..@............0..8............................text............................... ..`.rdata..b....0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AutoLoaderx86.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:33876D098A3F5EA51E20110B80A54A6B
                                                                                                                                                                                                                                  SHA1:0EF862A985946DB2C80D773357C20832D047B1DE
                                                                                                                                                                                                                                  SHA-256:1745EE03859D97A219C21317DCBA234AB8BEC882AA1A51F1CC66D6C732A1EA80
                                                                                                                                                                                                                                  SHA-512:4B5A9130F8EFB78D4F8316E968C9E375CEA6E995C3C5F91BD59EA1C22828820A5B258123C787F48F9C8C11E67039515B953FA33D39E3E0FBBCACA3CE78F1DAEC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..w..Lw..Lw..L~.mLv..L~.{Lz..L~.|Lt..L~.kLp..Lw..L6..L~.rLt..L~.jLv..L~.iLv..LRichw..L........................PE..L......e...........!.................#.......0...............................p.......w....@..........................;......P4..P....P...............6...*...`..8... 1...............................3..@............0...............................text...q........................... ..`.rdata.......0......................@..@.data........@.......,..............@....rsrc........P......................@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\AutoUpdate.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:50625820FA566539B7E4ADDE9CD447F6
                                                                                                                                                                                                                                  SHA1:5CBDA693D6C1963D1DFBA355C7C25D1099A029B3
                                                                                                                                                                                                                                  SHA-256:62DF0E3F928F58A78A9C50582EA40F514686FC094C909B2A9C99AE6A139159FA
                                                                                                                                                                                                                                  SHA-512:E8439E0235381607F9ABA222DF6A27F3A9B65DBD05D9A2C7648528B156ADD0758B941343AE1405BBD507F3EC04F16CBC89C18A1F2EFF60748B3EE2370D9F875A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......0.k.t...t...t...}...d....j.u...&...x...&...s......v...&...T...&...p.......z......p......}...t...6......R......u...t..u......u...Richt...................PE..L......e.....................p....................@..........................P......e.....@.................................h...........(............2...*......@.......T...............................@...............d............................text............................... ..`.rdata.."...........................@..@.data...............................@....rsrc...(...........................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BCD (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C2542D5B306CB4A7F08E09D11E4BD8FD
                                                                                                                                                                                                                                  SHA1:90519D8C6E5211C2088E4B98CCF19A4F501433F2
                                                                                                                                                                                                                                  SHA-256:01A466CE642B71320B7DE37A36FB6FD7E45E339A02A6854E882883BFDEAD42F0
                                                                                                                                                                                                                                  SHA-512:A78753E4FF24D2145DB0FFBDB9B93E0FB4904BE745A3C8CA497F8ACF68B4D03557548B0EA0133ECBD4103058194BC8F6B29E3D36F9842D9CA5B3621328EA21AC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:regfS...S.....f................... .... ......k.u.p.\.O.u.t.p.u.t.\.c.o.m.m.o.n.\.t.o.o.l.s.\.p.x.e.\.B.C.D...I]."@......PV...I]."@......PV.......J]."@......PV...rmtm../............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BCD.rst (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:363A3225BC21D3415E07B901F869EACD
                                                                                                                                                                                                                                  SHA1:7FFC3330DE2B3612E8194A3C26E52F1553882F63
                                                                                                                                                                                                                                  SHA-256:751E5839F1AC526DD5229D315D9A20E14D57B5278E49A9CD08C0FD4C8ABE7DC8
                                                                                                                                                                                                                                  SHA-512:2E8382D60A0E8D8ED998746C008B579EDEBA6933B553D97D3E32BF3C48A23AA75190F6BF171DB4B58FF2EE7CC5BB4BDF882DDE66E0748D40C834D8CDCA286C35
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:regf%...%...!.6[.................... ....P......\.?.?.\.c.:.\.b.c.d...r.s.t.......................................8........O..q..8........O..q.......8........O..q.rmtm....................................................................................................................................................................................................................................................................................................................................................f..k........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BCImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:88FC4AE11DB6A4C0841EBDA30F88CF65
                                                                                                                                                                                                                                  SHA1:83BCD113BDA798A7222994056B252BF8D13E3CE5
                                                                                                                                                                                                                                  SHA-256:2F4D8489BD37BCD597FC485436ED1FA57AE107CBFFCFB693DCF158EB4951D097
                                                                                                                                                                                                                                  SHA-512:9744BC60BB271610DEB515B834324B0AB49793D2EF96593FF138B8028B756ECBE6724912471E8F3BC2B75959B36A1B2CE9C10C34B80F37D070D10D1FA8A200BF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.Ch.VCh.VCh.V.'.VBh.VJ..VEh.VJ..VMh.VJ..VJh.VJ..VNh.VCh.V>h.VJ..VNh.VJ..VBh.VJ..VBh.VRichCh.V........PE..L......e...........!.....F..........-+.......`.......................................I....@.............................................................*......D...@b..............................x...@............`...............................text....D.......F.................. ..`.rdata..@k...`...l...J..............@..@.data...@...........................@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BOOT.BIN (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS/MBR boot sector
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BDD732AC156687D64F0307E7696F7992
                                                                                                                                                                                                                                  SHA1:4DD52CED3C90FC33D348A7D403115DFE06343FDA
                                                                                                                                                                                                                                  SHA-256:B6E5F8C464F4A747553C63FC352CB7EF9145C2B232E7E50E3679785D306E94EF
                                                                                                                                                                                                                                  SHA-512:F2A4DD1B21CA618038BC974D10A99F8E3A308013E2CB89FB79CBEA1F6ACD3D60AFAAF70415C8751D9C895C0AB7D21A590C3084DCF918CB434B84706D055324F6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:....xss......+.......|.........h&.........l.......f.....~...........7.a.........f.........rwfW.w..g.....u..7....r.......8.... ..f+.@....f_fGN;.s...+...r.f.......u..h..... S...f...f..@..|....v.r.......U.t?3.......8,|.u........f.|...|........D.r.....=U.u......L...........S.`+.....t.....a.`.....a.`..A..U.....a.`fh....fW.SQh.....B.....gf.d$.a.xssfs TBLD EASEUS Todo Backup Loader....Invalid Todo Backup Loader...........................................................................................U.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BOOTMGR.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6065FB9344E2B050C15485E94D664759
                                                                                                                                                                                                                                  SHA1:E48796C7B4E2D8D8AA9C0F8E3FB0EB9E62C27608
                                                                                                                                                                                                                                  SHA-256:0FF923CF6B8883F79E7F3220270A9CF3E6270AD915680774F3F2D6ED327B0E3B
                                                                                                                                                                                                                                  SHA-512:CFC1C9D69EB162950560D2270142AAAFBA818A092E626D3F7FE1BD33D41F0E2F6957543B522C9F33070AA60EAEAF094FC19B309109A4B242B82123B4C9776DAD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P'#D.FM..FM..FM..>..KFM..>..5FM..>...FM..>...FM..>...FM..>...FM..>...FM.Rich.FM.................PE..L.....[J..........................................@.................................+_..................................4................-..............@............................................................................................text....&.......(.................. ..`PAGER32Cu....@.......,.............. ..`PAGE.....:.......<.................. ..`.rdata..@...........................@..@.data...a...........................@...PAGER32R.....p......................@..@INITDATA............................@...PAGEDATA............................@....rsrc....-..........................@..@........................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BPVolume.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:14D098ED0428C1F530215DF4F7D71065
                                                                                                                                                                                                                                  SHA1:D6FA525E6EC5FD21F618CC90929D2C5E828B41EC
                                                                                                                                                                                                                                  SHA-256:61EA0E0C378AD1BACE6A24B63814596062D8459D7C32B36FAFA6A24447644889
                                                                                                                                                                                                                                  SHA-512:EE294E95305813B4741652E959A0461425F165F1E95A88C3F90E37849D292AD76F858B1CE4F22F36DB5AD99CF465728E89482820729D60A64611D7213DE82A44
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.].v.3.v.3.v.3....u.3.....3...f.3...z.3...a.3.v.2...3.....3...w.3...w.3.Richv.3.................PE..L...!..e...........!.....|...4.......k....................................................@......................... h..(....J...........................*.........................................0)..@............................................text...>{.......|.................. ..`.rdata..H...........................@..@.data....5...p...2...\..............@....rsrc...............................@..@.reloc..T ......."..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BackupCloud.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6BC1F92172552129B997E823A0495CA8
                                                                                                                                                                                                                                  SHA1:B2CD1D2CD68B1A2CC31E621A8AE91CF061036F70
                                                                                                                                                                                                                                  SHA-256:E97C4B635009F4E2C6F050E3B1419B539FCA88249F83F96684D0FA71E2894CEF
                                                                                                                                                                                                                                  SHA-512:229506E1E3083EFE8148167AED73915037C030D58DA87D409AE755B2FB39B82B8713D85059ECD62ADE48E4F8B5C89D6F25C100C97D071CA86E6235A275C049C9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..V..V..V.h....V.....V.....V.....V.....V..W.o.V.....V.....V.....V.Rich.V.................PE..L......e...........!.....v...B.......^..............................................x.....@......................... ....................................*...........................................T..@............................................text....t.......v.................. ..`.rdata...............z..............@..@.data...............................@....rsrc...............................@..@.reloc..z&.......(..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Boot.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F5F2411ACD6D6095604EE91180EC35BA
                                                                                                                                                                                                                                  SHA1:719BB9A557E44C8DEBCC7958E1DC46EE80C4B588
                                                                                                                                                                                                                                  SHA-256:D24EC5F9171C4F1944421A45A687E618E1CC1009741DCB8E94B9797809DA6EE7
                                                                                                                                                                                                                                  SHA-512:0F971939E8670E3D6499A04954E7AB7E28837078DC73C27EE002E17DBF39C18C26487B08E96CA2CF1096529060B481EF7B71E74B4BE652953585AC977B9F0BEF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^...^...^..v.Y..^...&Z..^...&L..^...&K..^...&\..^...^..8^..}...^...&E..^...&]..^....[..^...&^..^..Rich.^..................PE..L...$..e...........!......................................................................@.........................p&..$...D........`...............t...*...p..x&.....................................@............................................text...+........................... ..`.rdata..............................@..@.data....'...0...$..................@....rsrc........`.......<..............@..@.reloc..r/...p...0...D..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BootDriver.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:499E61DB860266692972A1619DFD7654
                                                                                                                                                                                                                                  SHA1:BF2D90D4CD60605996713E70BDCEF0563C9C346D
                                                                                                                                                                                                                                  SHA-256:9DAC27F9A3E292C2DDD4524E7E2EEF8295D6D78DFF6137092E2A97472FD0FEC4
                                                                                                                                                                                                                                  SHA-512:63A4A5F1C5F4F805D3609AAA7DD43EFB7CEF6969CFAC0003BADCBF2AC68D85DAF6C59F8EC5434D97EDBB0389CFFF688EE1E00F68D34859A19CFEA3EEF8648BE3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O........................................................ ...........................Rich............PE..L...K..e...........!......................................................................@..........................g.......T.......................t...*..........@................................G..@............................................text............................... ..`.rdata...h.......j..................@..@.data...t....p.......Z..............@....rsrc................^..............@..@.reloc..d............b..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BootItem.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:605CDBC8313DFF563D1E84EB6C33E0A5
                                                                                                                                                                                                                                  SHA1:0D7F1B9D78D6A6B3FEEE637CEC3505831F9E5683
                                                                                                                                                                                                                                  SHA-256:F1976D608800C13311AAD118AF326763819D3A59A77E4C166AB75AF8BD14DD8B
                                                                                                                                                                                                                                  SHA-512:CDFEA5939CD0A88E7765C6DC9D0613CD848F4024BE76A581D43198B33F3BE7EF73A738AA7893520BA2A1E2AD70E4D27B7C444A583C2DC8CDF0B98289413059C1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$&@SEH.SEH.SEH.....REH.Z=..QEH.Z=..]EH.Z=..WEH.Z=..TEH.SEI..EH.Z=..XEH.Z=..REH.M...REH.Z=..REH.RichSEH.................PE..L...I..e...........!.....$...$......3........@............................................@..........................Q..g...$K..P....p...............L...*..........@A..............................(F..@............@..$............................text....#.......$.................. ..`.rdata..'....@.......(..............@..@.data... ....`.......<..............@....rsrc........p.......>..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BrowserMail.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6EAC223AA1E5C67B12B487A79DDE6BC3
                                                                                                                                                                                                                                  SHA1:6E19F9E90C82D166165631B3E0BC5C644195608A
                                                                                                                                                                                                                                  SHA-256:853C1F9F9E19DFF3E52C7A4588975470DCF1F79027618F49A1DDC3E1273C8BD9
                                                                                                                                                                                                                                  SHA-512:D710796EADA1855D3629871709DC5A8E766175C87B5DF02E2F8263FD80A391218CF7EE660DC7483B81F4202D987D67F98EAE1F3F807BACAC4309CB7345B209DE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3]0.w<^.w<^.w<^.in.r<^..s.t<^.~D..<^.~D.~<^.~D.`<^.~D.f<^.w<_.~=^.~D.c<^.~D.v<^.~D.v<^.Richw<^.................PE..L......e.................$...................@....@.......................... ...........@......................... ...h................................*..........0D..............................0/..@............@...............................text....".......$.................. ..`.rdata...o...@...p...(..............@..@.data...............................@....rsrc...............................@..@.reloc...<.......>..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BuiltInUserMgr.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3DB07287611E1CE2C2DEA35E1CF4B0C1
                                                                                                                                                                                                                                  SHA1:BEF996EC373D18F71345B1685A1A85DEB3517FB7
                                                                                                                                                                                                                                  SHA-256:D6C774751F4AB4B89596312AF8465B2C720D0D2138A54C58E2A43B021A230183
                                                                                                                                                                                                                                  SHA-512:30BAABF6119350ACB3015C0DC01FA6884241478C18F8C03A649CF2FAAB9EEFA306BAAFFEE558CA3047925F951E2CA80F377E20F9DDA3F74AFE1C5F78AC9E87B7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..|..|..|..u.!.}..u.7.i..u.0.~..u.'.{..|..P..u.>.~..u.%.}..Rich|..........................PE..L......e............................3........ ....@..........................`.......@....@.................................D"..P....@...................*...P..L.... ..............................(!..@............ ...............................text...~........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Burn.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EDBC1C401C80E02B7259DB5D06B275A0
                                                                                                                                                                                                                                  SHA1:7D851DD7557DEF029775E346DC6174D84A74267C
                                                                                                                                                                                                                                  SHA-256:2AA315D330DFC59852F9A82F703C746DE393B63E95233AC1806FA8F386CE513B
                                                                                                                                                                                                                                  SHA-512:8FC07438C54AC44B17B8C863CD6C3000E60B81C93467C401391097DEC3681256EBF043B4D49AEDCF62FE2D83980029AE7F53BEAB98471A2CB040EC62BCE92F32
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'.t.F.'.F.'.F.'..c'.F.'.>`'.F.'.>v'.F.'.>q'.F.'.>f'.F.'.F.'.F.'.>.'.F.'.>g'.F.'.>d'.F.'Rich.F.'........................PE..L......e...........!.....B...:.......J.......`......................................>.....@.........................`...c.......<........................*......l....`..............................@y..@............`...............................text...+@.......B.................. ..`.rdata...&...`...(...F..............@..@.data...H............n..............@....rsrc................p..............@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\BuyNow.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7729C198C1A8F374190835C0EEBA0842
                                                                                                                                                                                                                                  SHA1:7B142EDFD6A56C6768FDB03CCAFBBF4024F234E4
                                                                                                                                                                                                                                  SHA-256:71110C7F2787F5D71AA180A213CD93094FDCCFE164D4C06F496FB22CF2CDA692
                                                                                                                                                                                                                                  SHA-512:53BEEA2A153716C9BE3DB0958F85A3604FAA85F31270484607C1B40557B2B23CA5E9F2E32CA352D623D513BDC867DC56A475E09C43DF54737098618B854AF905
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................7...W.%.....&.....0.......7.....L..... .....9.......!.....'....."...Rich..................PE..L...!..e...........!.................{..............................................+.....@.........................`v..C...$].......@..D............X...*...P...<......................................@............................................text.............................. ..`.rdata...U.......V..................@..@.data....,..........................@....rsrc...D....@......................@..@.reloc...G...P...H..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CMCAdapt.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3D750473403027F9E248FE8A3814530F
                                                                                                                                                                                                                                  SHA1:8244DDD0E2F8AD7E340676B73FB60355C6A8AAC9
                                                                                                                                                                                                                                  SHA-256:9E2E8AD29B15B7A818FB9812D4AA553647C5AB6C12C523F20601F769DBE55187
                                                                                                                                                                                                                                  SHA-512:AC5C41537BAF7677D5CF85679E0256C66F450D670AD7B6C40BB2551A869B0AFA4124CE0A52927084BC24A66F354E132567C73DCF90E215092888A43ACD524DA9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.X..X..X......X.. ..X.. ..X.. ..X.. ..X..X..0X.. ..X.. ..X.. ..X..Rich.X..........................PE..L......e...........!.....L...........3.......`............................... ......v.....@.............................v................................*...........b..............................X...@............`...............................text....J.......L.................. ..`.rdata...q...`...r...P..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CMCAdapt_RTTO.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EEBDAAE956AB39A9B8D656009DF99E09
                                                                                                                                                                                                                                  SHA1:A4DEBEE232338C66877F92E3948D4973DACE12AA
                                                                                                                                                                                                                                  SHA-256:99A97C3A07B1F1F2631DAE68CF72F2EF6E1B75D6C740FAF431741D2B5D2CC26C
                                                                                                                                                                                                                                  SHA-512:8D0070939F3A1E57C83ACC1D05D49A26A48E1F1DB8094F47B4303221C5F75D9F424436CF32B4A16BAF84EC4E5BD0459B657F72E1F5E04C98C48E2B54CCDB82AA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.............n.......................................s........................Rich....................PE..L......e...........!.................................................................M....@..........................S..{....9.......p...............h...*..............................................@...............\............................text............................... ..`.rdata..............................@..@.data...$....`.......F..............@....rsrc........p.......J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CMCNetTokenProxy.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AFC3CE4B97EF7B35ACCCCAB6DA35114D
                                                                                                                                                                                                                                  SHA1:A6C00930F071BF1F5AF622F47DD2094FAD9D52EE
                                                                                                                                                                                                                                  SHA-256:A65283FA59F9E9813339C853D03C6C83BB4418CA55C221DAB926173A51AEBF71
                                                                                                                                                                                                                                  SHA-512:67E7DC5FD7E6BCFFBD5DA7BC1DED4B00985F7291F15417170BBCF5A078EF45F2500100C37020B194D05C5D1FF38DF5EB4487CDC6B4D744FADA9A70903C9455F0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.q..."..."..."dJl"...".}o"...".}y"...".}~"...".}i"..."..."...".}p"...".}h"...".}k"..."Rich..."........................PE..L......e...........!................{........ ...............................`............@......................... +..N....&..<....@...............*...*...P....... ...............................$..@............ ...............................text...p........................... ..`.rdata..n.... ......................@..@.data........0....... ..............@....rsrc........@......."..............@..@.reloc..@....P.......&..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CMCPipeCenter.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:558C8EBAFD5370F1F64AE13F7D37721D
                                                                                                                                                                                                                                  SHA1:EB4C552874C8331329CF1AD2252BC8C491D941EF
                                                                                                                                                                                                                                  SHA-256:82E6E0B2ACC9662F96F419314EB07B5EC63077B75AA9AB57E888148283B4A2E9
                                                                                                                                                                                                                                  SHA-512:264C8EB46B9E9BEFC257A96C578B439136050BBD0C559A572B7F02D21C613B275735E446B93D4D7D5EB78D9BAD928D8940FAF9A5B965645991E7D37C537CC875
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...3...3...3.,.....3.......3.......3.......3.......3...2...3.......3.......3.......3.Rich..3.................PE..L......e...........!.........L......s........0............................................@..........................e......<N..d....................n...*..........@2...............................8..@............0...............................text..._........................... ..`.rdata...6...0...8..."..............@..@.data........p.......Z..............@....rsrc................\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CMCTbProxy.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3BE3E1E524C8A2A25C852DB2BE03899D
                                                                                                                                                                                                                                  SHA1:D29732B83253B86C72D8106D63229E31A0BD1D5F
                                                                                                                                                                                                                                  SHA-256:CE53718DED09B262274AF5D5FDBDA3C1F833AB27ACBA2F3E9D9DDD74F072E4EE
                                                                                                                                                                                                                                  SHA-512:20EE62A66F3F2F43B7BCABCA61F4958DE2AB97AA4A99D09DCDCB47EFA7C375BB1B02035071D5BD0BF6AF6DECFCD285A8B0191300CFD720DBC1E8520891A481BC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............Z.Z.ZT..Z.Z...Z.Z...Z.Z...Z.Z...Z.Z.Z..Z...Z.Z...Z.Z...Z.ZRich.Z................PE..L......e...........!....."...........+.......@............................................@..........................P..i....K..P....p...............D...*...........A..............................8F..@............@...............................text.... .......".................. ..`.rdata..)....@.......&..............@..@.data........`.......8..............@....rsrc........p.......:..............@..@.reloc...............>..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CalcScheduleTime.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:56A50D3314437A90B18936332F0A6922
                                                                                                                                                                                                                                  SHA1:EC287B6226AD2B79C069916E58218D424A2020F3
                                                                                                                                                                                                                                  SHA-256:2BCCC8D137B75D869B0C2C60C846962A1D1F613B098736D823E131DD18F3F9B3
                                                                                                                                                                                                                                  SHA-512:DC2E8A083985FBAAFE06645853735C9BFBA60B3F1A5FA35F5915E45F1D91BF0D28BB190AA8C8019A62936D0600D33ED2C57328B27D958EC7454F13F7BB8266C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c`]............dM.......z.......z.......z.......z...............z.......z.......z......Rich............PE..L......e...........!.....l...H......Ld...............................................1....@.........................@...v.......x........................*.........................................h...@............................................text...0j.......l.................. ..`.rdata...5.......6...p..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CallS3.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8A808959EB9E2E17A7AFC6F6ECFD6FAB
                                                                                                                                                                                                                                  SHA1:45A6F16F503B2C50C85F7992AE45BAFF6A9F36A3
                                                                                                                                                                                                                                  SHA-256:D76BB71E492F9C33D606A38CED889668B56EFC60E03B52E1EAA8A592FA39433F
                                                                                                                                                                                                                                  SHA-512:AC1DB8EBC33973CEBCAC0939E70EFE8298FC7D8F34671D8A3B7F728B6A9D079F83E5EDE3498A33C461BAA8BD9F01C47ACE819C1947D80AD6BD19755CC578CDB0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R~.j...9...9...9Dw.8...9Dw.8...9.v.8...9Dw.8...9Dw.8...9.gD9...9...9...9.v.8...9.v.8...9.v(9...9.v.8...9Rich...9........PE..L....<.d...........!.................................................................,....@.........................p!..X....!.......p...............V...*..............p........................... ...@...............8............................text...)........................... ..`.rdata..~k.......l..................@..@.data...(....P.......8..............@....rsrc........p.......D..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CallbackOperator.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:05356ECFF776BE4F509A433BB278A074
                                                                                                                                                                                                                                  SHA1:24792657913377C6F2D9D2D2E7174330827E3E9F
                                                                                                                                                                                                                                  SHA-256:D4ADB065FD3336AB28FCB7670EC98F4445A1314079337C17D6147BA0C73E1F9A
                                                                                                                                                                                                                                  SHA-512:A01912739CFE24DC3495638EFB4AD71BE1B78243AC1071091728443A18D7D61EAA561865E4029F02E7E783DDED12B051BE37A7BA313273FEDA5D18DA622D5360
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(p.I...I...I.......I...1...I...1...I...1...I...1...I...I...I...1...I...1...I...1...I..Rich.I..........................PE..L......e...........!.........,......_!.......0......................................<.....@..........................?.......8..P....p...............J...*...........0...............................5..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......2..............@....rsrc........p.......B..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CheckImg.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:18D516AE83D6287C932B63E763C1A6E6
                                                                                                                                                                                                                                  SHA1:2898FF64E677366EA6ACE8FF47AA7C23F2E51D02
                                                                                                                                                                                                                                  SHA-256:BDC8B789C582590C2039910C2CA7828419D813AE4BD19CDA9A35CBD69042B148
                                                                                                                                                                                                                                  SHA-512:FEE3E347325EB53964BBF5FF761F94B8C18042F4F313DCF6875FEDB35C87784D576CDF9E516DB9D7BFA637DD1318C18ED6B74D79A5CD2AF10B05E9DA3DD30B3D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............D...D...Dy.}D...D.~D...D.hD...D.oD...D.xD...D...D...D.aD...D.yD...D.zD...DRich...D........................PE..L...M..e...........!.........v...............................................0.......n....@.........................@.......,...d........................*... ......`...................................@...............@............................text............................... ..`.rdata..n(.......*..................@..@.data....?.......<..................@....rsrc...............................@..@.reloc..p.... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ChkHarDisk.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5E934804075F185F75C8E0771D312D5D
                                                                                                                                                                                                                                  SHA1:1C95EF03B3C63CB268434DAEE816CA002633696D
                                                                                                                                                                                                                                  SHA-256:426968882410D78A9FA555D939336E6BA49DC6F0FBDFDE8A15F6E88B9BFD0BCC
                                                                                                                                                                                                                                  SHA-512:F45FFB58FD7ED7B4AD382F5B5EF924BD529EB59DE2B543B701B10B5B7D8B53D0D930E25826073302E1454F3943060923941A5E38D5BFD11E81ADC5E495C744E4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IA...A...A.....u.@...H.v.V...H.`.4...H.g.u...H.p.B...A.......H.i.B...H.q.@...H.r.@...RichA...........................PE..L...H..e...........!.....H...~.......D.......`.......................................+....@.............................i.......(........................*..........pa..................................@............`..8............................text....F.......H.................. ..`.rdata...<...`...>...L..............@..@.data....>.......$..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ChromeData.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:435CC5606E526349CAB3FEF8FABF2B1D
                                                                                                                                                                                                                                  SHA1:9915847C87D829C621C0530BEDC0AFA0C9769923
                                                                                                                                                                                                                                  SHA-256:639136DEC38E95D274C6AD4DE1AEF9B3FE6756C5BAA7FC9EEB03A44436919F54
                                                                                                                                                                                                                                  SHA-512:1BA206F292A851950F3CD4D8C6B5F1384320A1645D6C8035511DFE4BFC747DE2CC6743CE2667FAFD3A070CBB98B8B3585FB69CD4CB43F9FD86A610A3B686ED2B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4.{mg.{mg.{mg...g.{mg..if.{mg..nf.{mg..hf.{mg..lf.{mg..lf.{mg.{lg.{mg..if.{mg..hf.{mg..mf.{mg...g.{mg..of.{mgRich.{mg........PE..L......e...........!................................................................s.....@..........................0.......1..,....P...............T...*...`..@...P...T...................H...........@............................................text.............................. ..`.rdata...m.......n..................@..@.data........@.......2..............@....rsrc........P.......<..............@..@.reloc..@....`.......>..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ChromeDataBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3EC47A9822B1AE803690424FD84DC969
                                                                                                                                                                                                                                  SHA1:8BA8B4F320A9AF651AE653ABEB6EDD1A1EACE1FF
                                                                                                                                                                                                                                  SHA-256:3CE8F0A358B031E7CDD8026E3F99EC4832799AC6CCA95786F5AFE3D9CA04353F
                                                                                                                                                                                                                                  SHA-512:3BD4655C51B3167729AFA40B07B025819973208507CD80E1A3E035122B2E00F4427719762E1FA4F255C8F2B2FF74DD3BD5E0F7D91FA1F038056698940F66499D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:..:..:.....8..3...>..3...4..3...1..3...5..:.....3...2..3...;..3...;..Rich:..................PE..L...[..e...........!.....h... .......T..............................................9.....@.........................0p.......S...........................*..........0...............................x(..@............................................text....f.......h.................. ..`.rdata...............l..............@..@.data................^..............@....rsrc................f..............@..@.reloc...!......."...j..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudDebug.ini (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Generic INItialization configuration [ImageLimitSize]
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4116E1C615D612FB69033D08EA83D64B
                                                                                                                                                                                                                                  SHA1:5377C00D712A508EC04C4950EB53A75104124385
                                                                                                                                                                                                                                  SHA-256:BE194C1A6B535856C54E3370294935B1AF462B7771A59C2BEF9AA9BD4ECF8E9A
                                                                                                                                                                                                                                  SHA-512:2D7518D0CBBE40E908A20CB0A361B5CAFEDAC7F2BF74B69BC6DA8A510E6BDBE21DAAEE84BC1069003F34F1CAFFD8B969CF9A42FFBB6A2E64B686B1BFD540904D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:[Debug]..TRACEARG=0....[ImageLimitSize]..OneDriveBusiness=5120..OneDrive=5120..GoogleDrive=5120..DropoxBoxBusiness=5120..DropBox=5120..Box=2048 ..Mega=5120..pCloud=5120..Sugarsync=5120..HiDrive=5120

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudInterface.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2989E6A612EF39C3BB415C91834287C8
                                                                                                                                                                                                                                  SHA1:C368C7FD3F0062D0DDA5B1822AC411B90C0733AC
                                                                                                                                                                                                                                  SHA-256:5C046315183F9CF79BFF63CA225441F1768C041BCB1E56E0404001A8CF6E02E1
                                                                                                                                                                                                                                  SHA-512:F1E2394315CBCDB49FB1B632BE09393ABF737B77C994D541DF9EB7CF897573D901883140FDD30D5BA5CDC6E48F82A2F9C1C831558FF35925DBB2214B482218F7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7..V.V.V...v..V..u..V..c..V..d..V..s..V.V..V..j..V..r..V..q..V.Rich.V.........PE..L...}..e...........!................v........ ............................... ............@......................... .......<...x........................*......L....#...............................}..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...............................@..@.reloc..V#.......$..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudNode.xml (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AA96C13A3AB780BD84C93265ACA7FC87
                                                                                                                                                                                                                                  SHA1:7FDE9E5E6AC580E7A5552403DF2080BFB3509C8D
                                                                                                                                                                                                                                  SHA-256:FF5AC96C63F9E41FFDE50DA4B20C3E5DF83396AC8548144EAA49C379DC7DD564
                                                                                                                                                                                                                                  SHA-512:3D692D5AED054F260B11D13E41773953D0701571B4B45FE23F9691329FD94246E65AACF8C5BB4EB9D0A14F38FA8F4C92A85232657DEDADB909C4E08E868EBFA8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>..<CloudNode>.. <Items>.. </Items>..</CloudNode>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudOperator.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:19005CD96E8372667A8D9EE9835B090E
                                                                                                                                                                                                                                  SHA1:3164BB2656E1751EF8FF1AB5D34659CA7AD413FB
                                                                                                                                                                                                                                  SHA-256:92A3EA9D3336D7C50E438CD7DD232B6B99ECC128CF982FEC17169C9711D9E07C
                                                                                                                                                                                                                                  SHA-512:6750C0263E1E1F11A33D4AA562B2CC22A51E6B465BB978FD2E6CDD98E0FEC1ED08272B632BAF376B17DC746CC728044985F6C53609E44251E484967875DB6F01
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}..o9.<9.<9.<...<;.<0..<8.<0..<<.<0..<).<0..<6.<9.<W.<0..<3.<0..<8.<0..<8.<Rich9.<................PE..L...z..e...........!.........J......}........................................P............@.............................l............0...................*...@......................................@...@............................................text............................... ..`.rdata...3.......4..................@..@.data...X.... ......................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CmdManager.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5C808F9A8700F53B20CE3692B38ACC64
                                                                                                                                                                                                                                  SHA1:4B6151749EE5952D054DE9A20FE71484E9E896D6
                                                                                                                                                                                                                                  SHA-256:33CB57794A67C7F8D1AA165F27D06B78EDD6A835BB752DAD93061E43485F9755
                                                                                                                                                                                                                                  SHA-512:C6B7FBD2026EF12168283BDAD533BC4516BF8F490F767CE647FAD47D61EF1B9A49F15434FF90EE4D647FBC7ADC764FF757A0CF36A3EF65CC746CF2711BEEE189
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q&.T5G..5G..5G......0G..<?..>G..<?..:G..<?..<G..<?..*G..5G...F..<?...G..<?..4G..+...4G..<?..4G..Rich5G..........PE..L......e...........!.....p...x...............................................@.......9....@..........................K......d...@........................*.......g..................................`~..@...............d............................text....n.......p.................. ..`.rdata...............t..............@..@.data... ]...P...(...@..............@....rsrc................h..............@..@.reloc...z.......|...p..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CmdPack.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B96F508C8904AA63C023BFF0E27FC85B
                                                                                                                                                                                                                                  SHA1:DAFA3A971A7FC227E8CE0CBE52F87AEA4C13C5F2
                                                                                                                                                                                                                                  SHA-256:9438947C2833AB78A473B08FEAF5A22B615D16F54D483DE54E6296EE23ECA7E0
                                                                                                                                                                                                                                  SHA-512:993DEBC76B6A16BD87C77C4F1F6765FF36B03DD686A6E144C7D41C7B1765B0A4D7E4051684D8C9FCA06DBA645B40EBDDC5EF019FFF49F9C8A330A2370691930A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q/v.5N..5N..5N.....4N..<6..4N..<6..;N..<6..2N..<6..0N..5N...N..<6..6N..<6..4N..+...4N..<6..4N..Rich5N..........................PE..L...{..e...........!.........B...............................................P......A.....@.........................`.......<...<....0...................*...@..........................................@............................................text............................... ..`.rdata...$.......&..................@..@.data........ ......................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CodeLog.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C858E0419781533BF494535985E6B0B8
                                                                                                                                                                                                                                  SHA1:844DADD0887E9C8F595B42BF1F3055433BF87F0A
                                                                                                                                                                                                                                  SHA-256:1E2E67E55DF15EAB387ED40DDE380B696DEF9DAF30FBCA90F746EE29422303EB
                                                                                                                                                                                                                                  SHA-512:BDE01682AE0785D7035A5329B22FA212022666FC031AF5E20EBEC94D616CC81EDF74F1886D819300320CD843CCF6F53D3FDE68644055564C59C1FD0767E3B108
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.B.'...'...'.."h*..'..._)..'..._8..'..._?..'..._/..'...'...'..._6..'..._...'..._-..'..Rich.'..........PE..L...3xUe...........!.....(...f......S........@......................................1@....@......................... ...f....y..d........................!......D....B...............................W..@............@..P............................text....&.......(.................. ..`.rdata...G...@...H...,..............@..@.data................t..............@....rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Common.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:08866BFB1EBA36E294501A1B10851C4E
                                                                                                                                                                                                                                  SHA1:AC8BC1B54EFFEBDDAE43308B5504295A850CD8C2
                                                                                                                                                                                                                                  SHA-256:0EA63D3B6A7D180981B69ED5866FACF8AD9E3D94FEE000C1DD764996D71DB778
                                                                                                                                                                                                                                  SHA-512:C3A66EAACFC9A3DE17B89E458B84240232BDE15779DCB97418C5D5D8DC54DCD00E61F836E3CC31E8C76B21567559BD12DB2138A5AC51E78C450B44EED6371EE2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..............^.......].......K.......L.......[.........f.....B.......Z.......Y.....Rich............PE..L...9..e...........!.................................................................*....@.............................G...|...P....P...............J...*...`......................................0...@...............l............................text............................... ..`.rdata..7H.......J..................@..@.data....+... ..."..................@....rsrc........P.......&..............@..@.reloc..J....`... ...*..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CompressFile.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C9CC043A793DFFF324221DF6F4E791EE
                                                                                                                                                                                                                                  SHA1:ECEFF62EBB01626587A7BF6A8DEEF533EC1BED7C
                                                                                                                                                                                                                                  SHA-256:412E8DB7AA2DDEE190F8F922E7CB6427E3EF99E2C83DF4F21DBE804F054BF64D
                                                                                                                                                                                                                                  SHA-512:02FB085229868E061748105C0BC297434E384FCF9493D5C8E571273ED1D32CB5EFA72B24D10E22694A571AAAD70963D849677A25ADFD0573DDA305586EDD8537
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.c.6.0.6.0.6.0~yV0.6.0.NU0.6.0.NC0.6.0.ND0.6.0.NS0.6.0.6.0.6.0.NJ0.6.0.NR0.6.0.NQ0.6.0Rich.6.0........PE..L...|..e...........!................Q".......0...............................p.......!....@..........................7......L3..<....P...............0...*...`.......0...............................1..@............0...............................text...X........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..&....`.......,..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ConfigIso.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:06DB9A3F4333B50A3470F7BE6B95A6C8
                                                                                                                                                                                                                                  SHA1:7D671135B45868134FC448BDE90E1D9E53651C07
                                                                                                                                                                                                                                  SHA-256:E4D0D2D6D01AED73BD6827BDD77C2C7DF314CDB80BFD35EC5C1393DD8BBB14BB
                                                                                                                                                                                                                                  SHA-512:5EA1B9DCFD4A0FD8A997935C88C659AA018F5A2664BC60D2B42D256CCA274B30F3E3C43623C322801D86FAD1948FF279320BC0EC92C33A0D3BC005809BC5318E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............q...q...q.|.....q......q......q......q......q...p..q......q......q.Rich..q.................PE..L......e.....................F......4.............@.......................................@.....................................d........................*..............................................@............................................text............................... ..`.rdata..(4.......6..................@..@.data...@...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ControlPxe.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:69DF3445AB737D93ACEE937B31A7BC05
                                                                                                                                                                                                                                  SHA1:95463BB746A1C6FA32B6F9714FA4B245B985E1B9
                                                                                                                                                                                                                                  SHA-256:0D3C9747C0A12DF128FCAF58F23C5E6C4C78DB5B6F34E38AF06A3391252422BA
                                                                                                                                                                                                                                  SHA-512:76DB241C1A0DE769D0196C828CEF32D6D236A91B1860DE9C35B1DF5B0F4082FA49651BD7964E4262E1023B8EEA6880B005ED804EF1E7DD1D5FB89E55B55F0D9F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.oSu.oSu.oS...St.oS|..St.oS|..Sx.oS|..Sq.oS|..Sr.oSu.nSM.oS|..Sv.oS|..St.oSk..St.oS|..St.oSRichu.oS................PE..L......e...........!................. .......0...............................p............@.........................0>..i....8..P....P...............:...*...`..0....1..............................(4..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......,..............@....rsrc........P......................@..@.reloc.......`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\CorrectMbr.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:167FD7761A717F5FBD7AC129F76A1FCA
                                                                                                                                                                                                                                  SHA1:B9519A43EEFEE0839FF2B3A35192C568322B341D
                                                                                                                                                                                                                                  SHA-256:A024965D07C460A129D85683C55880B8FFD6CF772268CEAF8CE8235E6C93950E
                                                                                                                                                                                                                                  SHA-512:6835936E8FD530DAFAD11D7D17E57FD546CC9A26E1E30AFA67E19A80DD4E72331FCD46AC435B9DF6017958B57336D1333B58A3B29D38E7417D0DDA80A6AF8076
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................y.{.....x.....i.....n.....~...........g...........|....Rich...........................PE..L...I..e...........!........."......e&.......0......................................cs....@..........................C..i...\>..P....`...............D...*...p..L....1...............................9..@............0...............................text...[........................... ..`.rdata..I....0......."..............@..@.data...L....P.......8..............@....rsrc........`.......:..............@..@.reloc.......p.......>..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\D3Dcompiler_47.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C5B362BCE86BB0AD3149C4540201331D
                                                                                                                                                                                                                                  SHA1:91BC4989345A4E26F06C0C781A21A27D4EE9BACD
                                                                                                                                                                                                                                  SHA-256:EFBDBBCD0D954F8FDC53467DE5D89AD525E4E4A9CFFF8A15D07C6FDB350C407F
                                                                                                                                                                                                                                  SHA-512:82FA22F6509334A6A481B0731DE1898AA70D2CF3A35F81C4A91FFFE0F4C4DD727C8D6A238C778ADC7678DFCF1BC81011A9EFF2DEE912E6B14F93CA3600D62DDD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.X.0.X.0.X=.DX.0.X=.EX.0.X..DX.0.X..FX.0.X.0.X.0.X..@X.0.X..EX.0.X..AX.0.X..XX@0.X..BX.0.X..GX.0.XRich.0.X................PE..L...n..R...........!......1.........7.0.......1..............................`5.......5...@...........................1.u... .2.d.....2.@.............4.h<....2....p...............................h...@.............2. ............................text...%.1.......1................. ..`.data...<.....1..^....1.............@....idata........2.......1.............@..@.rsrc...@.....2.......1.............@..@.reloc........2.......2.............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DKCBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:695A330355C213C5DE06090E4F0F3160
                                                                                                                                                                                                                                  SHA1:DF369E905C14C24AAF30AA3FE4FB86DB738A1DC8
                                                                                                                                                                                                                                  SHA-256:2C6ECD541747C868CBC485A5F67615148263790E00D5508D897BA2E84721F889
                                                                                                                                                                                                                                  SHA-512:671CB2E3B6E854C6746AD95297D0B51C0A60B3DCBDB5B89BFA808CA2C4F3F1EF91ABFF2F0CCE6BBA3B03D3CE51DC7EFC8BD55FA0A04F3E3988BEC42FBEDE434A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h,Z...Z...Z......[...S..R...S..T...S..Q...Z.......S..Q...S..I...S..[...S..[...RichZ...........PE..L......e...........!.....r...L......`8...............................................(....@..........................|..y....R..x........................*.......2......................................@............................................text...:q.......r.................. ..`.rdata..i............v..............@..@.data................f..............@....rsrc................|..............@..@.reloc..&@.......B..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DKCImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D8F2989A1D7799C27ED8E8DE02467191
                                                                                                                                                                                                                                  SHA1:8DA7E0E5FCD8AEE9890F2D954B5B2F6BA0C756C4
                                                                                                                                                                                                                                  SHA-256:DBC745626B6F2E983F0D7A9A665D2ED07C209AD3B6CE2C2A349FC8B1FE0F7C63
                                                                                                                                                                                                                                  SHA-512:1F6AC545EB734255CAD02CD86BA665014AEBB8792AD851EF72AFFE754A068FD4ED572422B4F3F1B92B064AA5A26556D0224B3B2ABC92AE997C08D51EA46958E6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O5...T...T...T....`..T...,c..T...,u..T...,r..T...,e..T...T...T...,|..T...,d..T...,g..T..Rich.T..........................PE..L......e...........!.........................................................P............@.........................p.......$...P.... ...................*...0...... ...................................@............................................text...k........................... ..`.rdata..............................@..@.data...............................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DKCRestore.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:35AC9DA85A0190D58F7117ECA644E224
                                                                                                                                                                                                                                  SHA1:F42AACD362265195FB9B8039AE9C27A04DA61BC9
                                                                                                                                                                                                                                  SHA-256:B3C9D1027E4DB9D03B92E0427834718D8561BF73175D5E3D7E108AF746C02785
                                                                                                                                                                                                                                  SHA-512:002B1D6306E74A305328CFF76B5A80BD4522D0FDEF94324A668D68D7BAE08C748E8DCD7DD9B7627C219CD0B9D1F8EF9F7E1DED72EED0D4B2DA8199D1D8F148C4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..k%..k%..k%.z$...k%......k%......k%......k%......k%..k$..k%......k%......k%......k%.Rich.k%.........PE..L......e...........!.....H...\...............`............................................@.........................0.......x............................*.......9..Pc...............................C..@............`...............................text....G.......H.................. ..`.rdata...k...`...l...L..............@..@.data...............................@....rsrc................\..............@..@.reloc...G.......H...`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DataFile.ini (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7F411750D07619F38537E7FD612B8B44
                                                                                                                                                                                                                                  SHA1:CDA241A1CE5141288582C8F0AC4850992B427BDC
                                                                                                                                                                                                                                  SHA-256:AE89726AF2BD0C0218FBF63AF20D4464F44DCED5156364D817B6E73AFC8E9F87
                                                                                                                                                                                                                                  SHA-512:35DAD46325060004A66E01E10AF6A3EBFD94B6751347B6EC64840C4EC03D81480FC324494EA39DDED03BF2F1A1CE352B15AB518D14214C15567AF17FB32F16B8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......[.H.E.A.D._.D.A.T.A.].....T.O.T.A.L.C.O.U.N.T.=.0.....S.T.A.R.T.I.N.D.E.X.=.0.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DataMana.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2DC27034C8FDF782C245C0B6CD27778C
                                                                                                                                                                                                                                  SHA1:C6326BEB793F52B9DC456C1A2074C6199AB57EB9
                                                                                                                                                                                                                                  SHA-256:90A9ECC1F37C526C952BB86B47B0DF50D85175C7BB3A0EA59B90FE58FDAB2EB6
                                                                                                                                                                                                                                  SHA-512:118E46AA3B350C8E9629C17B4840764CDC089C62E18F2B1DC7742BF8EC41A65DC04F5ECBFD751C2666A9BD9FF71A37A082937B4F0D91D8F0F9465A757D865A60
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VM...,...,...,..p3...,..}3...,...0...,..}3...,..}3...,..k....,..k....,...,...,..K....,.......,...*...,.......,..Rich.,..................PE..L...l..K...........!................]...............................................................................p%...+...........p..H.......................8....................................................................................text...2........................... ..`.rdata...P.......`..................@..@.data...8....`.......`..............@....rsrc...H....p.......p..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DevCtrl.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:585353E5EA55A84DBE56C4CFC5829C30
                                                                                                                                                                                                                                  SHA1:2198BE1DE2536AE582D6F496146B9D99608839FF
                                                                                                                                                                                                                                  SHA-256:C3F7890CA7C30C3279B3D7C145CA3F87BFB3621CA2EA027DF7E4BE96405C0DA0
                                                                                                                                                                                                                                  SHA-512:52ED461A17BEEB0FE511C66FF0BE7B339BEB91D59131D72D656E4901549DA43C06189581845708B223FF6754AEADB1F97C3EAB710EE252315EC208B49C142C10
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.G...G...G...%...M...(...E.......C...(...C...(...C...>...D...>...E...G..........D...A...T.......F......F...RichG...................PE..L....F.K...........!..... ...................0.......................................................................J......xA..x.......8.......................8....................................................0..l............................text............ .................. ..`.rdata..#9...0...@...0..............@..@.data........p.......p..............@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Device.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A7E249E4A21AD971B24E05D132269599
                                                                                                                                                                                                                                  SHA1:7A5B4A7554835C40BBD7580315951BDD839F1D96
                                                                                                                                                                                                                                  SHA-256:5B48B99B14ADDF1552CCA8AE73CA057AB5EBCE6571B4A8296D0B602AA3E109D0
                                                                                                                                                                                                                                  SHA-512:191D6B3A4FFA2B3F13CCDB3FD31E2DC17DBD6036042773A5B7F595F3EB330AEC5763D33E2C5B2600A64D62B8D7CE1DB3874261541F9FB0810B9A1097757AEC9B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x..+7I..x....J..x....[..x....\..x....L..x...x...x....U..x....M..x....N..x..Rich.x..........................PE..L......e...........!................g........ ...............................`.......*....@.............................G...H...d........................*... ..."...!...............................:..@............ ...............................text...=........................... ..`.rdata..7p... ...r..................@..@.data...(f.......X..................@....rsrc...............................@..@.reloc...2... ...4..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DeviceAdapter.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F64C1464CF3055B2316C0D42693BC366
                                                                                                                                                                                                                                  SHA1:2BB026E6F79F1A055529A12324CBBEABF7827796
                                                                                                                                                                                                                                  SHA-256:BE1087A063792B07CB5805836E799344FAEDAD6BA2ACFAE53A286DE4070BE1F5
                                                                                                                                                                                                                                  SHA-512:FB49744644F035A754A1C5F86B1148A1A61D432E121A65BB16EDAFF13668A91ABCE6E4B42ED3FCE3C65666BA5CC9C9AFDE9863347A0E039A160EA2E0CBE8E06C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{...?...?...?.....k.=...6.h.>...6.~.1...6.y.;...6.n.:...?.......6.w.=...6.o.>...6.l.>...Rich?...........................PE..L......e...........!.........:....... .......0............................................@..........................9..n...L5..<....................V...*...........0...............................1..@............0...............................text...F........................... ..`.rdata.......0......................@..@.data...8(...P......................@....rsrc................L..............@..@.reloc.."............P..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DeviceIO.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:47BBCA4D9ADCFB1799A28D22AF556BE2
                                                                                                                                                                                                                                  SHA1:E6221162F563E1EE2B3C1EDD6E352D6EF0FF1D87
                                                                                                                                                                                                                                  SHA-256:600B38A0E283F40B79228E4AB1948A1B55080517247C519078F2A06FDAA9F6FD
                                                                                                                                                                                                                                  SHA-512:B7BA410FC61D64EE535033C1DCFFF5B28EA1E8632D289C41BFFC3E420CCCE79608E2F6136B65E6843F11D9D7A0BFF510B9215D20D330B5003A6FC65F39B47890
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a..a..a......a.....a.....a.....a.....a..`...a.....a.....a.....a.Rich..a.........PE..L......e...........!....."..........C).......@............................................@..........................O..g...(H..P....p...............D...*......L...0A..............................XC..@............@...............................text...+ .......".................. ..`.rdata.......@.......&..............@..@.data........`.......8..............@....rsrc........p.......:..............@..@.reloc..b............>..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DeviceManager.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7B8BA5A0C6FB5B4EC231E1616FA19EB2
                                                                                                                                                                                                                                  SHA1:E26162BDB325024EF41B5578A17C66EE313A48B6
                                                                                                                                                                                                                                  SHA-256:BAF0F648F53277350286FE3380731F1F270B26ADEDFE561295F11D7F2CD647A0
                                                                                                                                                                                                                                  SHA-512:7FC33245D1DFF2748D7B7EC6F4B03C7472AA3BEBCCE0C41884A6D98B07A6A6F5DF196C4E6AC9DE5AD8AF375293ECB517002C65416E6EA6C33C6E5BABFDD2FD66
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.....}...}...}......}......}.......}.......}......}...|.2.}.A.n...}.......}......}......}.Rich..}.........................PE..L...-..e...........!.....................................................................@..........................................@...................*...P..(L......................................@............................................text.............................. ..`.rdata..a...........................@..@.data....r.......T..................@....rsrc........@......................@..@.reloc..T....P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DiskFileRestore.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A9FB66DA6A97FFB516C21AC139C5E546
                                                                                                                                                                                                                                  SHA1:E8935527713E7C7FC57C376AB9780D794A862934
                                                                                                                                                                                                                                  SHA-256:D2DFC97F2B2641775DFC500FB0A27AABD2C067D5DFECA6CE4576D594C3298715
                                                                                                                                                                                                                                  SHA-512:BF670494BB21B1D83478AD6978A96DBF5FE57C968E51770018D25E6CD02C93DF9EA32ACCD5DE5FADD7A22C94D9380658B5F9720D9CDD0F7AC8627EB2ACB240A0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z...;...;...;...t/..;...C,..;...C:..;...C=..;...C*..;...;...;...C3..;...C+..;...C(..;..Rich.;..........................PE..L...h..e...........!.........Z......y........................................P......N.....@.........................p...n............ ...................*...0..........................................@............................................text...u........................... ..`.rdata...6.......8..................@..@.data...............................@....rsrc........ ......................@..@.reloc..&....0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DiskSearchImg.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:989233DEA432C6F5668E26E75090B0DE
                                                                                                                                                                                                                                  SHA1:F36780DD4451F7AFB14E8411271123618BEFB8BB
                                                                                                                                                                                                                                  SHA-256:7CA70C61C214DA2FE1C9B94144EF805D4804CDE49996ACBD222E06A366065AA3
                                                                                                                                                                                                                                  SHA-512:EAB3B84C98FC84C7C5394A7BE39D3864BEAE4617D80F86CDC675C4EBF5D9E704D70DC48170EC58281E80AC69AAF4AB7E73898ABBFF521AEEFD71242CA167C03A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.K.y.%.y.%.y.%....x.%.p...x.%.p...w.%.p...q.%.p...~.%.y.$.>.%.p...u.%.p...x.%.p...x.%.Richy.%.........................PE..L...g..e...........!.....6...*.......<.......P.......................................#....@..........................e.......^..P....................d...*.......... Q...............................S..@............P...............................text...K4.......6.................. ..`.rdata..l....P.......:..............@..@.data........p.......R..............@....rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DrvSetup.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:800C208319C01258F6102677DD5C5231
                                                                                                                                                                                                                                  SHA1:5DBE9BF0A4149D9DC30816987EF8E43C0D77D9EE
                                                                                                                                                                                                                                  SHA-256:8F1694D64A65A76AAF57E76C70F8F252FB97220C1248F73133E56398F0199431
                                                                                                                                                                                                                                  SHA-512:EE3EE128DB5CC6097CCFDDA11F149FD0D3AC405974AB0C66294589544883035058E7A81CCF8A459C8577FA4B7BF5A810284FA3A9AD128E106E523C9B74CCA005
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...`...`...`$.U`...`..V`...`..@`...`..P`...`...`T..`..G`...`..W`...`..R`...`Rich...`........PE..L......e.....................r....................@.................................#9....@............................................8............b...*......T....................................|..@...............X............................text............................... ..`.rdata..T...........................@..@.data...8...........................@....rsrc...8...........................@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DsBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:32D63E48026263BAE3C6965468E825D5
                                                                                                                                                                                                                                  SHA1:ABFBB456F827450DE67F228A0B796E7B39E2099C
                                                                                                                                                                                                                                  SHA-256:A7691EAD24DE3AA4C0B2BD13523BE406DF7EEE6815254BF7CED0376FE0516E7D
                                                                                                                                                                                                                                  SHA-512:7488E617E2B637692D586C73BBD11C34CC4109C4B79303A974AB9AAA14088072658FDC4B238C9F91B93E69896E885A48A008FEF85A641155C72677A418A6CE95
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%..gv..gv..gvs..v..gv..v..gv..v..gv..v..gv..fva.gv..v..gv..v..gv..v..gv..v..gvRich..gv........PE..L...5..e...........!.........................0...............................p......RD....@.........................0...g.......d....0...............0...*...@.......2..................................@............0..t............................text...z........................... ..`.rdata.......0....... ..............@..@.data...\2.......0..................@....rsrc........0......................@..@.reloc...#...@...$..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DsImgFile.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D9971FC4E1FC10B2AF97F900656A1D9F
                                                                                                                                                                                                                                  SHA1:8AD1B5E3F0562428F6D2B47665BC66747F624B66
                                                                                                                                                                                                                                  SHA-256:074D5355D18B2A9212CA2A588C21DE7A851B7D89AB7F48B1280E27A4D6F2C731
                                                                                                                                                                                                                                  SHA-512:0897739328000AA59C97F6600524EB26BD8F999F0BAEA6EE2B399C0D8B754AA4216AA0A2F74B531001C1A44A880A4C71D26D7786A2682B8B9C727DEA41704715
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.G^V..^V..^V......\V..W...TV..W...OV..^V...V..W...FV..W...UV..W....V..W..._V..W..._V..Rich^V..................PE..L......e...........!.....0..........i........@...............................0.......W....@.............................................................*......(,..PB..............................0P..@............@..4............................text............0.................. ..`.rdata..}o...@...p...4..............@..@.data....,.......(..................@....rsrc...............................@..@.reloc...;.......<..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DsImgMerge.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2C75F8E56180E970BD0803E31D888F39
                                                                                                                                                                                                                                  SHA1:22AF894278C39D717A416FDADA61DC710FE4CB74
                                                                                                                                                                                                                                  SHA-256:E783F264392603565579797B2F958B9C2E4690D5DC4D84DB3A5BCDE98BB82CDD
                                                                                                                                                                                                                                  SHA-512:166F1DA0FB35335B9B98371A7CDECF1B0E347F83397C28F6D24106D7134137CF2EF2E12CD53BB5D02378031D9A15B37B84A2FEE9705116A13483E2ABB880D853
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jm..........."D.....s.....s........0...s.....s.....s......s.....Y.....s.....Rich............................PE..L......e...........!.....H...................`.......................................i....@.................................L........ ...............F...*...0...Y...b...............................2..@............`...............................text....F.......H.................. ..`.rdata..+\...`...^...L..............@..@.data....T.......(..................@....rsrc........ ......................@..@.reloc...j...0...l..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DsMonitor.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:08C97C839BDF19222ECEA2618D0D92A6
                                                                                                                                                                                                                                  SHA1:0D8308C5AE2777D4D343827C61DC5D87FA3E84BA
                                                                                                                                                                                                                                  SHA-256:5AE3368B359FAC980BDA959995801A24F5CCD71DB0F96F914407B11695FB8661
                                                                                                                                                                                                                                  SHA-512:E6522D35405F4A7268BF7962316D7A8195C4624909A08E9FC92EC5DC5E1B1CB32D1DC02A9C4FCD056497FF8B252D1123B6A1E8E6F7B94FB753DC0F044184EB2E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........GS..&=..&=..&=.Ti...&=..^...&=..^...&=..^...&=..^...&=..&<..&=..^...&=..^...&=..^...&=.Rich.&=.................PE..L...F..e...........!..... ...........(.......0...............................p......+A....@..........................;..h...D6..<....P...............<...*...`..<....1..............................x2..@............0...............................text...[........ .................. ..`.rdata.......0.......$..............@..@.data........@.......0..............@....rsrc........P.......2..............@..@.reloc..,....`.......6..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\DsRestore.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F3B19DC141C6FCAE3BCFD1D9D7D0759B
                                                                                                                                                                                                                                  SHA1:C9D4EC06853638AD6655266D133A8DE13776AC3C
                                                                                                                                                                                                                                  SHA-256:79A9293AE39B984BFE083B00C0E44C40B75B2D2F418AE89A2996636C0521E71D
                                                                                                                                                                                                                                  SHA-512:ED67BDC984ABBE7CEF10D2C8F2BE9C852CADAC83D44F7AA9F4075F6F759C6946CE3FCD9BE876EB666EAC0DF47BBDF5976CB9FBDB5401655541BDDBE166297AB7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........D.D.D.....F.M...F.M...K.M...K....F.M...a.D...M...~.M...E.M...E.RichD.........PE..L...`..e...........!.....x...z......O#.......................................@.......A....@..........................@......|...|........................*.......\..................................`r..@............................................text...*v.......x.................. ..`.rdata..3............|..............@..@.data...\U...`...@...D..............@....rsrc...............................@..@.reloc...m.......n..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EASEUSLD.LDR (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS executable (COM)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:49B62A2C1B5DFEFF2C4310257C2C1F47
                                                                                                                                                                                                                                  SHA1:E17116EFEEF786960CA5A738FD20CE775573DD43
                                                                                                                                                                                                                                  SHA-256:6CA18AC89EF4483BCE8D55E285B4BF1F4D676BEE4E450051A38CB74114C7F996
                                                                                                                                                                                                                                  SHA-512:A346431E45857166CA0F1FE818438F1CF05C437EE5919B8F334F665B049D669BBF49942575F1389275A69E03C420EAA4925C057B280DFE2FF9A1E75CC00B9396
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.>.. 9.............................................................[..C........SjS../..f.>.................t..L.h. ....1..........1.A..r......1.1........f.GRU.f9.u...... ..f9.uJ.r;......$?t........h...1.`.2.as.`1..).aOu....w/.......r.w...1.....1............RVWU...]_^Z.....f`......`.. ...."......f1.f1.f..$...f.....$..".....1.V..|W..V.............f........ ....fa...h.......<.u....Missing helper...............................X....P....r0.>..U.u(.....Kj@.......'.f1.1..D..u.8T.u.f.D.E.t....................................................................................................................[......"....1.1...f.t<..t.1.f1.f@u......U....f.......D....\.f.D.f.D.....f`.B.J.fa.fP.[.b.f@.............fXf.>......u..1..........[...........S.......Q............u.9.t.... ... .r;.....1.1.......h=..... ...1.1....................Ku..+....p.. x..............-.....-....Ku..1.....f1.6..f...............N................................/BOOT/EASEUSLD.LST......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EFIBoot.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:211B9E08E27067F13CE4A00341936477
                                                                                                                                                                                                                                  SHA1:B7EC515BCC71448E8DF6A5F51F73E5D87C97498A
                                                                                                                                                                                                                                  SHA-256:ABA9A5B591A7100B002BBE69700304FA05BD930F9A83F8A47AD61277C51F207D
                                                                                                                                                                                                                                  SHA-512:7495D22D17EFDBA3DD84BF69FB1D444113DC337CDCDB60A892F8F7CF778D7AAE4C0F2DBAE136764B91CF6C2087BD7E266C4EEF08F13800B6D86ECCCB9362AE51
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k...._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._Rich..._........................PE..L...B..e...........!.........................................................@.......d....@.........................`...f.......d.... ..<................*...0......`...................................@...............@............................text............................... ..`.rdata...l.......n..................@..@.data...$...........................@....rsrc...<.... ......................@..@.reloc..P....0......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ESLOADER.REG (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A7B72570D9B146D16306B8BD3BCF08CC
                                                                                                                                                                                                                                  SHA1:E84089E3C96C8ED11D5F3BF4D011590E8F673378
                                                                                                                                                                                                                                  SHA-256:29546D3B8C9A0F423D1D6DDAF5A3E77FDB8C9A014ADD42977FA9C4DD9B167DD5
                                                                                                                                                                                                                                  SHA-512:9DDD03BEF826AB48263CB4376380860F6BC23505106D8C77618CAC36DCA3A59C8409AD2A01840A13C88042B8179DEEEB71823B6A5895BF14F4A9F7868B44732E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:regfh...h....A..................... .... ......T.B.N.e.t.\.O.u.t.p.u.t.\.T.o.o.l.s.\.E.S.L.O.A.D.E.R...R.E.G..........N.PV..........N.PV..............N.PV...rmtm....................................................................................................................................................................................................................................................................................................................................................\...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EUFyncFtp.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9160F18CA5FF12FBFF70D0498D3295B0
                                                                                                                                                                                                                                  SHA1:7F7AFB23D0DC7CC47FDAF2B94976B51C5FB4BCB0
                                                                                                                                                                                                                                  SHA-256:6BD850DDC0CECBCFD14248CCFD5861A30C4BE3ED8320B86FDDDC631DE9CD4E39
                                                                                                                                                                                                                                  SHA-512:8A3C3A4D72AD9DA4018DC65BB91F632F8605BA6AC5B054AA233C0E04639AC41897A509A4B7E9F51621FE31F4F00A9138D243F0601F360246D223FB292469CBA9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................(.*....).........8.....?..../.........6.........-...Rich...........PE..L......`...........!.....|...L.......O....................................... ......d ....@.........................@,..:...<...........................X.......DZ..P...................................@...............P............................text....z.......|.................. ..`.rdata..z...........................@..@.data....?...@... ..................@....tls.................N..............@....rsrc................P..............@..@.reloc...x.......z...R..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EULicenseDLL.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:504734CC1D1062CC5556BF9B61BE3D8B
                                                                                                                                                                                                                                  SHA1:635B295DFF3A4AC59262AF52B7EC5B8A80360516
                                                                                                                                                                                                                                  SHA-256:0BAB51D1395BC3478D19B56FE462424E5EA5D4B56BEA6A3C5257230C42F47D3D
                                                                                                                                                                                                                                  SHA-512:75EFE459CA3309F0571DBC448EEDCECE2F54245501AD5DD4FCB4F913649BE678F8B5C9F09EC4D44731666BA4E81C2122204A4AABCAB25533747A6D108B6F48AE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ..Kd...d...d...m...A...m...r...m...9...m...c...d.......m...a...m...e...m...e...Richd...........PE..L......e...........!.........R.......+.......................................`............@.........................p...x...D...P....0...............&...*...@..h...p...............................(...@...............8............................text............................... ..`.rdata...).......*..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EUinApp.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:221B7E46EBBBCA5ECAABF2B3D02BDB7D
                                                                                                                                                                                                                                  SHA1:0B5DBE78A80BBB5D8793AAC1E52DAA2A31228348
                                                                                                                                                                                                                                  SHA-256:3DEB0C0EBD6A66AB0E053E62125756E32F3755B7D69AC8F91DDAFCE8D4854EA9
                                                                                                                                                                                                                                  SHA-512:D7019F3E18C5CD121087DB24A3B1FBEDB50FD81F9D281C0E23C37B6789657E4663280D9CA900B53161CBC4A18290D92DDEE540901E6DBD62D506EA18CC27B0A7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h..b;..b;..b;;..;..b;...;..b;...;..b;...;..b;...;..b;..c;..b;...;..b;...;..b;Rich..b;........PE..L......\................. ...$.......%.......0....@.................................W.....@.................................p:..x....`...............H.......p......p1..............................03..@............0..L............................text...w........ .................. ..`.rdata..f....0.......$..............@..@.data...D....P.......<..............@....rsrc........`.......>..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Email.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:63B7145C16F95EBDCEC202F67B1C0B4A
                                                                                                                                                                                                                                  SHA1:ED178F7EBF85B6834842922E5F932EFF8440F1E6
                                                                                                                                                                                                                                  SHA-256:9E9A2C33CC5A941FD4D92A98A58516CB6C0A5AD4D08DC7572A2D391F8A9B048D
                                                                                                                                                                                                                                  SHA-512:2388D519BA57CEC709B70883E62A4E2E3FB5396A6EC42E7980E582F3454BB1E3A4DF62C5A3D200A00CF9A6F7BE757C8EB2236D690EB1C935ACB4E9038232A710
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..}...}...}..\2...}.......}.......}.......}.......}...}..(}.......}.......}.../...}.......}..Rich.}..........PE..L......e...........!.....F...........7.......`...........................................@.................................t............................*..........@c..................................@............`...............................text...@E.......F.................. ..`.rdata..M\...`...^...J..............@..@.data...............................@....rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EmailBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F53E1A71AB26A2BAF7DD28390020C5CA
                                                                                                                                                                                                                                  SHA1:D73F14B5AE7A5393C0F3792EEB4C7A2CE985E3A0
                                                                                                                                                                                                                                  SHA-256:B84E02A73E09F04B3842BB4DB4BBE3FFE9BC2943DACB98EFC614A49FD43B7EB7
                                                                                                                                                                                                                                  SHA-512:0941AD95BAA0309A13C1D598721D80491A232D1E067CC65D99583D10DF54D9E5E9EEA692E49497E85972AFDE63C5DF26B6E2E7A999DFFF8B6DFCCD0576D56403
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.b.$...$...$.....&...-...'...-..*...-......-...-...$......-.."...-...%...-...%...Rich$...........PE..L...\..e...........!.....$..........k........@............................... ...........@.........................0.......,...d........................*...........B..................................@............@..\............................text...z#.......$.................. ..`.rdata......@.......(..............@..@.data...d...........................@....rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EmailBrowser.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9AE04F4235F4018A10E181EC47D28162
                                                                                                                                                                                                                                  SHA1:CA709609EFA2DAA30EF4C3255DF66FB159EB04D7
                                                                                                                                                                                                                                  SHA-256:540D518B1AD31AA0E277E4969B29B904E0F773AF31A8947BBE121D74FC57F7D3
                                                                                                                                                                                                                                  SHA-512:3A1B66AA02351C86680086F37F437A7BBF55FB5A038E933AF0B3E8826ECA65939870C63AD36CC66E9A7E2FEF9F77169DC022F1E41FFD967C6623F98E1AB874E4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......An...............@.......w.......w.......w.......w..........\....w.......w.......w......Rich............PE..L...Y..e...........!.........\......[........................................`............@..........................(..k...L...x....@...............&...*...P..........................................@...............x............................text............................... ..`.rdata...H.......J..................@..@.data........0......................@....rsrc........@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EmailRestore.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:59A598B8B462A432192ACCB1B78FEE02
                                                                                                                                                                                                                                  SHA1:47566F346CA0FE31846E0456A07444E529E2BE22
                                                                                                                                                                                                                                  SHA-256:A196164B0B5660E871EE8053641B17E348858C376F30E4450A4BB532FFA7EEA3
                                                                                                                                                                                                                                  SHA-512:AB8D78373DE8D777A14FC7EDE2DB38BBCA40C9E2C1AF535DDF89F0E8748ACEABFD27C90C9CABEE9A3E3594A686714EE65D565EB96571A9E34F8E9153935DF419
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................}. ......#......5......2......%........l.....<......$.......'.....Rich....................PE..L...Z..e...........!........................................................`............@.........................P...........P....0...................*...@......................................8...@............................................text............................... ..`.rdata...d.......f..................@..@.data...............................@....rsrc........0......................@..@.reloc..X....@......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EmbedUpdateBrowser.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1604F6AD002904C7E59C068EC54E534A
                                                                                                                                                                                                                                  SHA1:12253B0F45A10761F9EBDB76A2E4D1A1EB582374
                                                                                                                                                                                                                                  SHA-256:11D68120D59F48EEFA9EEC1F6212971443DE17196E3BC08E61A6EB88CE41A8B3
                                                                                                                                                                                                                                  SHA-512:7C4538AC486AFC49DDD1D7FA19C7047BC53701361A77C3D0E72A132EDC026288CE7B373C7785899C25DB99FC0EB657917B0FB8705F539141469914CDC534BA6C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......%5..aT..aT..aT..h,%.oT....q.`T..3<..mT..3<..fT...=..cT..3<..AT..3<..eT...0..oT...=..eT...$..hT..aT..kP...$..`T...=..@T...=I.`T..aT!.`T...=..`T..RichaT..........PE..L...X..e.................6...*.......~.......P....@.................................m.....@................................../..........(............d...*...........Y..T....................Z......(Z..@............P...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data...............................@....rsrc...(...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumDisk.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5CDB0C237A86A0FBC3CF553911BEA7A3
                                                                                                                                                                                                                                  SHA1:7E79D7EB6D74FE5263703505B321E08B3C66F537
                                                                                                                                                                                                                                  SHA-256:C552F20A39AFFD55868A15416A223BD658A6A9F5E6CDF1B8B12BD635DFD9B699
                                                                                                                                                                                                                                  SHA-512:329509CB419BD417B5FBBD1862907F749AE5E28286F1925198199B90D3E29124EEF09495AB4624C6883EAB13F360011778F63060B9C56F1F70426DF914CE4D28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..............S.......d.......d.......d.......?.......d...............d.......d.......d......Rich....................PE..L...S..e...........!.....|...........v..............................................z.....@.............................N............................l...*......$... ...................................@............................................text....z.......|.................. ..`.rdata..............................@..@.data...@U... ...D..................@....rsrc................H..............@..@.reloc..D........ ...L..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumTapeDevice.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:721DD4941FE03B6158E1878ADF00ED18
                                                                                                                                                                                                                                  SHA1:85A1DD692342B8C6763C5B0289C829DDBED5ACFD
                                                                                                                                                                                                                                  SHA-256:CBA1624A956642DCAB70237424A7C4D3263874FB082A94B27D539B19D25D6C0B
                                                                                                                                                                                                                                  SHA-512:3669FC4D00DD4C55896B98A0A2F79D8C6BDB2B0153FD87566E09197135481639FCCFEAC5D324CA89EBEFE173D472BCDAAADDF0B5E1BAA282C9013998F7577128
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z..Z..Z....U.[..S.V.[..S.G._..S.@.T..S.P.S..Z.....S.I.Y..S.Q.[..S.R.[..RichZ..........PE..L...M..e...........!.....8...........>.......P......................................Pw....@..........................l..m...._..d....................j...*......L...pQ...............................U..@............P..X............................text....7.......8.................. ..`.rdata..}....P.......<..............@..@.data........p.......Z..............@....rsrc................^..............@..@.reloc..B............b..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EraseData.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5885C433492F5195E9681490443DD2A0
                                                                                                                                                                                                                                  SHA1:610E2D5C1B433F088718A037344367D93769C9CC
                                                                                                                                                                                                                                  SHA-256:566A19CE95C25114F6D2DBCC3FD1A6026C991F5182A11A0705E19CFEE3752C50
                                                                                                                                                                                                                                  SHA-512:C2847587418938702F55D1DEEF2359E1A98507C448C0C18B061F3CDE69B633DDFBD0CE1AA31A5A3FC453457B4BD85AD6DC603E01F1122A24DF8B43906DB96BFE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jy...............W/......`,......`:......`=......`*.........K....`3......`+......`(.....Rich............PE..L...O..e...........!.....J...&.......P.......`......................................~.....@..........................s..h...\m..<....................t...*..........@a...............................f..@............`...............................text...[I.......J.................. ..`.rdata.......`.......N..............@..@.data...0............d..............@....rsrc................h..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ErrorReport.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C72FC984836BBDEF11CCDA73A20F636B
                                                                                                                                                                                                                                  SHA1:C3A09CE497CE186D18CF8E752A0E503F1462AA41
                                                                                                                                                                                                                                  SHA-256:9AF9DB05CA814F924F6B397B9DB7546537F8842BAF4EAB022DA69BF1F5C6B7D8
                                                                                                                                                                                                                                  SHA-512:6AABCD14B5651712E254DF6F7D24EA154E4AE7CE9A895524979EEF1844F9C6BC401071B1747BABD2AB49CDE5F0E7C991474760F85312C4289339BD1A1C04AD1B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\)..2z..2z..2z..z.2za*.z..2z..6{.2z..1{..2zW.;{..2z..7{.2z..3{..2z..3{.2zW.3{..2zy.3{..2z..3z.2zW.7{.2zW..z..2z...z..2zW.0{..2zRich..2z........PE..L......e..........................................@......................................@.............................................(............z...*..........`...T...................X...........@...............D............................text............................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuActiveOnline.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7FCE74F0394A679A2BCE943FC2C35FC3
                                                                                                                                                                                                                                  SHA1:9F080758AB253642EE87299B44C223AD0174E2C9
                                                                                                                                                                                                                                  SHA-256:82F24CCB6A5620B375BFCB6187F82EF1DB8FBD5FBCA5B4A3CC5C9DCBDCEFA716
                                                                                                                                                                                                                                  SHA-512:64E49832A219864F49C32F6393EE019B991593C9B0467F83ED26D84475862676D70BC81D2BEF8FC8ED284D7222C76CE98BEF38E83C1AA5DA6E04E2F4ACFD42F0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........MT.s.T.s.T.s.J...P.s.]...I.s.].....s.].....s.sK....s.]...E.s.T.r..s.]...C.s.]...U.s.]...U.s.RichT.s.................PE..L......e...........!.........4......H........................................p......EX....@.............................................................*......,q..................................Hm..@...............L............................text............................... ..`.rdata..............................@..@.data...|...........................@....rsrc................v..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuCom.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3C89BBA00D0000E102F3AF0A3A0BC1C3
                                                                                                                                                                                                                                  SHA1:6C97C879E10BFDEA7DEA07BEE7C194557CCA3C9A
                                                                                                                                                                                                                                  SHA-256:E9AA74AF680361C857A1F9FBFD960029BB22D2F00AAF7926BBB100EA459A2E87
                                                                                                                                                                                                                                  SHA-512:481619939707EBD2F2DF79A7B04D532B096F9A198B535B1CFD0DAFEA6F907095DF41A82DA9906283290FA844006EA279A02A37AF4573F62582F6BAF5181BCFD4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.;G..U...U...U.......U...T.%.U.......U.......U.......U.......U.Rich..U.................PE..L....).P...........!......... ...............0............................................@..................................P..<....`...............@..X....p..X... 5..............................`5..@...........,Q...............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....idata.......P.......2..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuDownload.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5BB7638E18ECD54AA8EC5BB24BD4B9E3
                                                                                                                                                                                                                                  SHA1:D3773E9B2274C986986A6491025FB66A33F6F6AD
                                                                                                                                                                                                                                  SHA-256:FB4A6AEE3FB97EB50DB9593F64CE60189CA8C83E8A87593E7D26B158466D4EA2
                                                                                                                                                                                                                                  SHA-512:707ACA012492501EED6258B342CE8933630EDDF213E44EF904C5A1114F4493273B853D96042CEC798ACB80B578BE9E195FDEBBF0EA714DE2F64B544B61E4EFF9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$qk.$qk.$qk.>..'qk.-...:qk.-...cqk.-.../qk.$qj.qk.-....sk.-....qk.-...%qk.-...%qk.Rich$qk.................PE..L......e...........!................./.......................................p............@..................................s..d....p...................*...........................................W..@...............T............................text............................... ..`.rdata..R...........................@..@.data...H............v..............@....rsrc........p......................@..@.reloc..l...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuDownload.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8D30DEA5566E8E3E74111A54D71E0767
                                                                                                                                                                                                                                  SHA1:3274E8FEBD7362A1E17E7EAC6D63BF7CA5BD4A9F
                                                                                                                                                                                                                                  SHA-256:DF5243C1C0DA45EF5CC717E1B321094379990415B0E74DFB51199B261514059F
                                                                                                                                                                                                                                  SHA-512:0D2DADD667E487849ACC604172FD85AA5C25D645A2B1AD7F76C1641137C161E04F0FCDF084DE50704384C8C5F8DCA23305F123F105F15F3BFA250F1F67EBA8B4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d...d...d..m+%..d....&..d....7..d.... ..d...d..ud....0..f....9..d....!..d...."..d..Rich.d..........................PE..L......e.............................c.......0....@..................................*....@......................... .......l...d....................$...*......H....2.................................@............0..H............................text...Y........................... ..`.rdata......0......................@..@.data...............................@....rsrc................@..............@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuImgPrtUser.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C1B106AC0E45B53CF656CF75D65F64C0
                                                                                                                                                                                                                                  SHA1:77D8FCA6D9E7A761B29ECB47999D24ED7A2DEB55
                                                                                                                                                                                                                                  SHA-256:DA32A33A3D92D8672EF5CEFCB7F445908A2CBDB3A89A0CE4F3C02C4F3E482E84
                                                                                                                                                                                                                                  SHA-512:104EA7A3307CF8E23847314337195C7B244D558225D1E90E09208BC5EADEA7EC4223D371FF9B2DBDC7E0487E8573C2C723A417ACEF788D4F7133D36708017FFF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......qP:,51T.51T.51T.<I..=1T.gYU~11T.....41T.gYQ~#1T.gYP~?1T.gYW~41T.ZUR~41T.ZUP~41T.ZUU~>1T.51U..1T..X]~<1T..XT~41T..X..41T.51..41T..XV~41T.Rich51T.........................PE..L......e...........!................G........0............................................@..............................................................*......X...0w..p............................w..@............0...............................text............................... ..`.rdata..`l...0...n..................@..@.data...............................@....rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuPipe.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:57CCC0EBBE9FE870BE3D673071EDE113
                                                                                                                                                                                                                                  SHA1:1965864146D05C3EA7DB2CE7F731C9FA885D19CA
                                                                                                                                                                                                                                  SHA-256:65655E6CD98FC7FCA16E3564F47CDC1362DB87C380DCBB82CDB34D73938C9C58
                                                                                                                                                                                                                                  SHA-512:5B1A90E20AF2A2ECD94A6DED302F4E9F2D361D3EE44C9807C406FEAA521C84853406DDDBE56DFF970C4D49DB2CD03B54929267E6D42C18A937BA941FE77339D7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p'.i4F.:4F.:4F.:..<:5F.:=>?:5F.:=>)::F.:=>9:?F.:4F.:JF.:=>.:=F.:=> :>F.:=>8:5F.:*.>:5F.:=>;:5F.:Rich4F.:........PE..L...v..e...........!.....^...:......._.......p......................................b.....@.........................@.......x...d........................*...........q...............................v..@............p..<............................text....].......^.................. ..`.rdata..4....p... ...b..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuUpdate.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EAD49ECDBEFA4A8ED0BEB09C667EA5E9
                                                                                                                                                                                                                                  SHA1:979544CA46B974D716F4A221B1D1F2247AA50CB0
                                                                                                                                                                                                                                  SHA-256:BFD035A18965F384F2DBD85F83C46DA8A99CF3C28AAE284259509EE0E7070DD6
                                                                                                                                                                                                                                  SHA-512:E04BA7FF1571A9610FECF2ED80B6325F8713297FF34C57495E0A2A3BFED4BABF3E85FC9F7F27338DE687DCFA52EE730480AF8B3515D6073D6510D650C41A8BE4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9..D9..D9..D0.sD,..D0.bD|..D0.eD...D0.uD<..D9..DQ..D0.lD0..D0.tD8..D0.wD8..DRich9..D........................PE..L...~..e...........!........................................................@.......Q....@.....................................<........................*..............................................@...............|............................text...A........................... ..`.rdata..............................@..@.data....6..........................@....rsrc...............................@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuUserRate.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:055E9B99F0321F89ED21E779E717AEE1
                                                                                                                                                                                                                                  SHA1:CD2C8F201F320F616A956D6334D58A6288A14482
                                                                                                                                                                                                                                  SHA-256:D3C09FC693DC795E3BB2C019BA093463EEA08CCA5A9329FA229DF32E095DCEE6
                                                                                                                                                                                                                                  SHA-512:06FBC30BE53D84015838942C893C5B4C2B82495BB4A0BE8100D899E20CF93602B32E70B149DFB42FCDBAABA8DEA3608FBAF4CE5712CF9515334AD669A9DE972B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U5X.4[..4[..4[.[{...4[..L...4[..L...4[..L...4[..4Z..5[..L...6[..L...4[..L...4[..f...4[..L...4[.Rich.4[.........PE..L...+..e...........!.................a.......0............................................@......................... ...z................................*.......... 6..............................h...@............0...............................text............................... ..`.rdata.......0......."..............@..@.data....... ......................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:11803F6B2728EE157DC1FC0A253EA3F7
                                                                                                                                                                                                                                  SHA1:C4027A4C5718EF785F1115130A326D6541B0E769
                                                                                                                                                                                                                                  SHA-256:3AF44524A92E88EB2A3D93713B96EE5E43310245E24AB726CB67215CE8EACDA6
                                                                                                                                                                                                                                  SHA-512:57AB4B7C12ACC93AB14871F9B9A758FAD74F8718C3B6CF3826C1A128D3E09DB9BD40C3E23F2101EF811F8513B2B1D23C35DAAC4203EA73115B2AD98B5FF0779D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.v.>..F>..F>..F...F<..F7..F6..F7..F$..F7..F1..F>..F...F7..F(..F7..F ..F7..F?..F ..F?..F7..F?..FRich>..F........PE..L......e...........!................`...............................................n.....@..........................l..f...PW..........@................*......D3..................................`...@............................................text...)........................... ..`.rdata..&m.......n..................@..@.data....!...p.......b..............@....rsrc...@............|..............@..@.reloc..BA.......B..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExcludeFilter.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DD9C2F00D4675CB281970467C06F4E3B
                                                                                                                                                                                                                                  SHA1:4E36F908957426897498F6C20367DAAFFADABDD5
                                                                                                                                                                                                                                  SHA-256:04A26019899AE046AB7E4BADE499B6AB41B12B8CF6A169B61AD0F46799645C34
                                                                                                                                                                                                                                  SHA-512:08DB6BC123C1D586DFE08BB4ADDEE85A087EBA3078585DFB642A1E830E7E51558D94BB2379984150854F211F9A85883A7F965A80EEE80DFE028C45C4208E7772
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h...................................................................Rich....................PE..L......e...........!.........<...............................................0.......&....@.............................l.......P........................*... ..........................................@...............l............................text.............................. ..`.rdata..,&.......(..................@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FATFileSystemAnalyser.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CA6BEC56C7AD2E14EEC0CC947C111069
                                                                                                                                                                                                                                  SHA1:7BC35B80E049427225D0E34084958BB3D490C394
                                                                                                                                                                                                                                  SHA-256:40173B01C6CF8B977E2A1EEBAE95A7547880CF7B1DA17792692EE003FCC8C9DF
                                                                                                                                                                                                                                  SHA-512:BC0B7C400B0C39E11E16282331274DBB3CC0E09139A1611ADAD58D9833AC373531C32D092DA8C9FDA1C596CBE5EDE40B326BA37B2256D86F529844E80DF131C0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:J.u~+.&~+.&~+.&.d6&|+.&wS5&x+.&wS#&p+.&wS$&{+.&wS3&y+.&~+.&B+.&wS*&q+.&wS2&.+.&wS1&.+.&Rich~+.&........................PE..L......e...........!.....n...l.......o....................................... ............@............................V.......P........................*..............................................@............................................text....l.......n.................. ..`.rdata..&*.......,...r..............@..@.data....0.......(..................@....rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FATSupport.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8643B92297BE585A1A4B74B84A1ABD32
                                                                                                                                                                                                                                  SHA1:DA1862CA3C196C75E6A587CE45AB63A6B1FE3B11
                                                                                                                                                                                                                                  SHA-256:39C76B2183916A5CD483E520F1519B965C3B03760D4F8ECD8BF3E3D1A22A4F1C
                                                                                                                                                                                                                                  SHA-512:07A635B28A9EB58C4FBCB5F0F6E6B7F3C6F9ACFBA577650D46885E8C5F10E283E25BFDF97F6DB5C6B73AE7BF51136F7570D086DCA6A5140605BCBFAA1E469386
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.m.9...9...9.....;...0..?...0..7...0..=...0..>...9...z...0..=...0..8...0..8...Rich9...................PE..L......e...........!.........d......d........................................0............@.............................i.......P........................*... ..`...0...................................@............................................text...?........................... ..`.rdata...6.......8..................@..@.data...l#....... ..................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FDMount.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F582E095DFD2B0AB8AD780A6E1C485A1
                                                                                                                                                                                                                                  SHA1:21B26BFC7B5D83E9D5A0FDDF991BBD1AD2A556EC
                                                                                                                                                                                                                                  SHA-256:E54B49072B60436BD9F7D946E112C5BFD562988CE4064792231BCBD12D4C00CB
                                                                                                                                                                                                                                  SHA-512:FBF2F50574A23B66176E26B431C712787C7169135753125D9C0623DEBB4ED22956F14B1020C037E9C44197FAC7DF1A680FB0FF7736BFD0D95F4553FF252F8A1D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n...*t.]*t.]*t.].;"]+t.]#.!],t.]#.7]$t.]#.0]#t.]#.']!t.]*t.].t.]#.>] t.]#.&]+t.]#.%]+t.]Rich*t.]........................PE..L...V..e...........!................^........................................`......].....@.............................f.......x....0...................*...@......................................x...@...............\............................text............................... ..`.rdata..V...........................@..@.data........ ......................@....rsrc........0......................@..@.reloc..T....@......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FDMountExe.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E1512AF606517FBEDA2E508E228091EB
                                                                                                                                                                                                                                  SHA1:53DDA9D512CC28565F82C686C16830CDA23543CC
                                                                                                                                                                                                                                  SHA-256:D30A474E755A908A07394768B041EDA4CA9143CEAB9AFFE11BA0B29C1E3317F3
                                                                                                                                                                                                                                  SHA-512:DCFDC0978F9A267CA521B9B4CE34B69A5A7856F4EFAC9490537BEF85C926744A6015A890DAD2B6935E2FFE6ABC87CB2C1B0891E066A35C3A1AD62B6AD4387327
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................c...............................................Rich...........................PE..L...U..e.....................................0....@..........................p......9D....@..................................7..P....P...............2...*...`...... 1...............................3..@............0...............................text............................... ..`.rdata..v....0......................@..@.data........@.......(..............@....rsrc........P.......*..............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FLCBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:18C17CCB25A0DCC70EBC9064BA677B65
                                                                                                                                                                                                                                  SHA1:123D39C7F2E82E8E8581B0B7082CB2521EBD4D9F
                                                                                                                                                                                                                                  SHA-256:11034AC5097CC70D915052DAA27DE4E1A9F0FECACF6108F6942CBEE0DA5A0179
                                                                                                                                                                                                                                  SHA-512:D884381EECFEFE50F13528D79BD7D1176DFD9A66C8871D77FFA8545DA187A1732E08D8C56B00DDC01EDAAC6EB61C72FB89F2F9C0DBE7E2287558B686AF3772D8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ib..(...(...(..Lg...(...P...(...P...(...P...(...P...(...(..&(...P...(...P...(...P...(..Rich.(..........PE..L......e...........!.....&...................@....................................... ....@..........................%......@........@...............H...*...P..@...PC.............................. ...@............@.. ............................text...z%.......&.................. ..`.rdata..B....@.......*..............@..@.data........0......................@....rsrc........@......................@..@.reloc...(...P...*..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FLCImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A4478A619DC3684EC32EE87811415697
                                                                                                                                                                                                                                  SHA1:A8387970B72EDF3E317EFE1943DAE5144292C115
                                                                                                                                                                                                                                  SHA-256:17193D652661DDF54B885BFC66BB8B8E22B389717579DBAB53140721D53D6650
                                                                                                                                                                                                                                  SHA-512:E00E95EAAACEB04CA9E8C584C3BB9729521346478B81A75FAFC80B1D7118B78DFFB2801B5332B0D4089D554FBD6561211D2BC9B42AAEF7AFBC1DF6008FD3EA61
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|^..0...0...0..R....0..e....0..e....0..e....0..e....0...1...0..e....0..e....0..e....0.Rich..0.........................PE..L......e...........!.....v...D.......{...............................................J....@.........................0...g...P...P........................*..........P...................................@...............(............................text....u.......v.................. ..`.rdata...2.......4...z..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FLCRestore.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:35F40F4A694545582DF499AA3971228A
                                                                                                                                                                                                                                  SHA1:1FD973B743DF874A11B8D425A8CB5E55B6DABFE6
                                                                                                                                                                                                                                  SHA-256:9A00BBE781D973989A72BD36B6B898F30A66151D389E1789880C06F2D862198E
                                                                                                                                                                                                                                  SHA-512:C6945DC1A8CB9D2003A86159B73D634CB5375304A8E3AE32A4547ADE9D398D027AE3E7267BC5CE12A5C341006395F3B01DF06A9B56059B8F7463362F3061B135
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f...".M".M".M..$M .M+.'M%.M+.1M,.M+.6M+.M+.!M3.M".M..M+.8M,.M+. M#.M+.#M#.MRich".M........PE..L......e...........!.....&..........M........@...............................0......{$....@......................... ....................................*..........@C..................................@............@.. ............................text....%.......&.................. ..`.rdata.......@.......*..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FLPImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2620EED0045758479BB8EEF61BA8CF85
                                                                                                                                                                                                                                  SHA1:30C1E5922092481AA20C7355B941B977C1747DBF
                                                                                                                                                                                                                                  SHA-256:5D81D602580777299439C9E30225DE1002BC41EB0AE28E79290EE307504F2330
                                                                                                                                                                                                                                  SHA-512:39774EFC0EFB29AFC26BB18C6FC7D68E8DBF76F093CBF8E3E3238D05DFA97A8C5DC86EF4E516086441F8FE6456404E00A85F1E4BD952AE9DC06A5EE5440C803A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ads`%..3%..3%..3.J.3'..3,}.3&..3,}.3(..3,}.3!..3,}.3...3%..3O..3,}.3-..3,}.3$..3,}.3$..3Rich%..3........PE..L......e...........!.........^...............................................`............@..........................)..g.......x....@...............&...*...P..........................................@............................................text............................... ..`.rdata..'J.......L..................@..@.data...d....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FTPTest.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:33C8C405A55735E2A909779BDAC4CBB0
                                                                                                                                                                                                                                  SHA1:DE7857E767B9B13A44B5C19E78D42EE3FCCB08D9
                                                                                                                                                                                                                                  SHA-256:A97007E812D9063672E26F8E8C7317A167F325FB039043609CEAEF1791859A21
                                                                                                                                                                                                                                  SHA-512:16FB1C410B967C496113A32D06CEEF82B23DC96BF7AD16FEE6154C551D1A308EA08940F212F54B25539749CC2CDBA198E3683F2A2664F4BAA80F95EF9BB06E23
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.Lo.."<.."<.."<..<.."<..<.."<..<.."<..<.."<..<.."<..#<8."<..<.."<..<.."<...<.."<..<.."<Rich.."<........PE..L......e...........!.........................0...............................p............@.........................P:..f....5..<....P...............0...*...`.......0...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..X....`.......,..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FatCopy.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FA6C64237767708324D598B965391D15
                                                                                                                                                                                                                                  SHA1:1141B9D6F61B363B27F9D8C34CF867A6923E6D05
                                                                                                                                                                                                                                  SHA-256:357B8E085CAC3813508A8506C57B2F36EA191AFE575F4D256ABD91E55AE2D0D3
                                                                                                                                                                                                                                  SHA-512:05FEA66765B834B9BB9E7F3125EF39EAED8855E6005576CA81CA284ABFD6203EABF82C0FFED7478CB252055913CFCCE41993D23F83D8FE6496084EA4BBC3237B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........G...G...G.....o.E...N.l.B...N.z.I...N.}.B...N.j.L...G.......N.s.W...N.k.F...N.h.F...RichG...........PE..L...1..e...........!.....^...".......[.......p............................................@.....................................x........................*..........pq..............................X|..@............p..\............................text....\.......^.................. ..`.rdata..i1...p...2...b..............@..@.data...D...........................@....rsrc................l..............@..@.reloc...............p..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FatLib.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6D3CBB70C6FD1ECEEB0D5392D4CCC812
                                                                                                                                                                                                                                  SHA1:DA03585F9EC5C522D94ACEE3738729D0511400D4
                                                                                                                                                                                                                                  SHA-256:D593AA615F5BC59D96C9766D573247188D6CE6C253445189F028336F4BBB9082
                                                                                                                                                                                                                                  SHA-512:FDF28E783FA5D9540AAA195FC93478A4903A075A8A7C7B9AD8FBFBCC1A58283E568187765DAFB30F88704FB8120F4AA21287DFC977D04AD998480752A9175430
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........|.sx/.sx/.sx/6<./.sx/.../.sx/.../.sx/.../.sx/.../.sx/.sy/.sx/.../.sx/.../.sx/.../.sx/Rich.sx/................PE..L......e...........!.........................................................`.......Y....@.............................T.......P....@...................*...P......0...................................@............................................text............................... ..`.rdata...%.......&..................@..@.data....P.......J..................@....rsrc........@......................@..@.reloc..N....P......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FatResizeMove.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0C56328D1211D36B679F95D9BA11730C
                                                                                                                                                                                                                                  SHA1:59C3DA79443F42C80BE53C1B6BBB9E2044AD608E
                                                                                                                                                                                                                                  SHA-256:2950A610BE32B20BC7C6F459013E108D99161CBD3D20290941093E36DB2D535B
                                                                                                                                                                                                                                  SHA-512:D285AF579927BAB32F389386219240788F2C43E4DE83D569F043DE9CAAA023E678B4D77C27C15B0BD81511441C31778800ADBD41DC1B236A518A3177493855C3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|..............bRe......ef......ep......ew......e`.............ey......ea......eb.....Rich............PE..L...@..e...........!.....L...........J.......`......................................X.....@.....................................x....p...............f...*...........a...............................m..@............`..`............................text....J.......L.................. ..`.rdata...2...`...4...P..............@..@.data...L...........................@....rsrc........p.......N..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FileExtend.xml (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:37FD55F8EFAB63059A754E4EDF689E1C
                                                                                                                                                                                                                                  SHA1:7A580EF42CEC64AADC4F1501208B9F985178366C
                                                                                                                                                                                                                                  SHA-256:82DD3AE435A5E23ADFF312D2F77F1657F5015EF9E91DEAAB24C8B36FEF2EE3D5
                                                                                                                                                                                                                                  SHA-512:7B03008FFD048BACC2E50CAAB5E4C37CEEB5127EE6D97422D9A9D529110F8F7DDDE8BA2A016E369312BADDE165F64B415B705C8686C35D4D13225A58670E34F4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<EASEUS>.. <GROUP default="Yes" name="Video" icon="../res/video.png">.. <EXTEND default="Yes" name="3G2" icon="../res/iconView/3G2.png" comment=""/>.. <EXTEND default="Yes" name="3GP" icon="../res/iconView/3GP.png" comment=""/>.. <EXTEND default="Yes" name="3GP2" icon="../res/iconView/3GP.png" comment=""/>.. <EXTEND default="Yes" name="AMC" icon="../res/iconView/AMC.png" comment=""/>.. <EXTEND default="Yes" name="ASF" icon="../res/iconView/ASF.png" comment=""/>.. <EXTEND default="Yes" name="AVI" icon="../res/iconView/AVI.png" comment=""/>.. <EXTEND default="Yes" name="CDDA" icon="../res/iconView/CDDA.png" comment=""/>.. <EXTEND default="Yes" name="DIF" icon="../res/iconView/DIF.png" comment=""/>.. <EXTEND default="Yes" name="DV" icon="../res/iconView/DV.png" comment=""/>.. <EXTEND default="Yes" name="DVR-MS" icon="../res/iconView/DVR-MS.png" comment=""/>.. <EXTEND default="Yes" name="FLI" icon="../res/iconView/FL

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FileSearch.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:785DA74663D5A347B16A9319159FA80D
                                                                                                                                                                                                                                  SHA1:CB1266C504AC2A3B1BB391BDB34006147C9EFA1C
                                                                                                                                                                                                                                  SHA-256:E1238DF5592C5780C6AE9DD62224C9C2DFAF9538930272989DFC891613786FFA
                                                                                                                                                                                                                                  SHA-512:9A35A4F3972A49FBEE38951812EE18A4DC93EB1F65D0DF951B3BC1A7B44BDB2CE336DA7294750FA472D5A54B4500781A124C3B1013C20422808ECBAA38B42A58
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Pr).1.z.1.z.1.zZ~.z.1.z.I.z.1.z.I.z.1.z.I.z.1.z.I.z.1.z.1.z.1.z.I.z.1.z.I.z.1.z.I.z.1.zRich.1.z........PE..L......e...........!.....6...........0.......P.......................................`....@.........................P........y..d........................*......h....Q..............................x`..@............P...............................text...+4.......6.................. ..`.rdata...9...P...:...:..............@..@.data....7.......4...t..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FileStorage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:86B61F835392365A59DB5E008D22A589
                                                                                                                                                                                                                                  SHA1:2F9E3036A91830BFB008DA9640F050EB81FCE923
                                                                                                                                                                                                                                  SHA-256:1AF7BC16664AD830B0B657285ED844AF1630579C6B61651075C1E3CB579B10EA
                                                                                                                                                                                                                                  SHA-512:653F5165CC1EB1ECB8B4ABBB85EB73D97A4C9C67CEE731D4224C9F81178B93CD0746AC765B6B60A3A72A127573EC1E2C78A6CB8BB1DDBB00D14A755D3CB44189
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................-...............8.......?.......(.........q.....1.......).......*.....Rich............................PE..L...s..e...........!.....T...........Q.......p...............................P......C.....@......................................... ...................*...0......ps..................................@............p..4............................text....S.......T.................. ..`.rdata..jb...p...d...X..............@..@.data...d9..........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FileSync.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FE090AB7F45CDD3514E7B34ECD721635
                                                                                                                                                                                                                                  SHA1:D12159E4EF777BFFD4C95E095C5E7328F8945DAD
                                                                                                                                                                                                                                  SHA-256:450AEEC5C932B22D6AD2CDE43C3F6933DB6DF8507F6B11CFF86759EAC5C83720
                                                                                                                                                                                                                                  SHA-512:9AD0B67FB0902DDEE29A8C43DE2659669D469641601E7517CBF1246BC996A6A3FEF8AFA3C4DF93B8AF876E143CD4562668FD3F25B5F58F3DEE11B288796373C9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................h.R.....Q.....@.....G.....W..........N.....V.....U...Rich..........PE..L......e...........!.........R...............................................0......6.....@..............................................................*......4$...................................q..@............................................text.............................. ..`.rdata..............................@..@.data...h...........................@....rsrc...............................@..@.reloc..D,..........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FileSystemAnalyser.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:95C7087A4F16E94474C69ECB70642456
                                                                                                                                                                                                                                  SHA1:CA066C0CF8AE717AF9232DED7F69DFDE0851D1E7
                                                                                                                                                                                                                                  SHA-256:C2624B0B4D86CCEBEF4BB7AC47706D02D5F65C0399C84122FDFB1262A09658C6
                                                                                                                                                                                                                                  SHA-512:9BCF6F5D252A925A4BC63F2DCD956246D85B2264CAD4C70014DC8BCC35CE397B0A90485C4DD96973B6ED18D4D477AE6974A683072C356AAAC22842CB7A03A80F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...J...J...J.".....J.......J.......J.......J.......J...K...J.......J.......J.......J.Rich..J.........PE..L......e...........!.....R...Z.......W.......p......................................:.....@.........................0...........P........................*...........q.............................. v..@............p...............................text....Q.......R.................. ..`.rdata...'...p...(...V..............@..@.data....'...........~..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FileSystemCheck.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0457C18BEDED9071E6C0D47D156B16AA
                                                                                                                                                                                                                                  SHA1:487AAE20748425DB50BA78F2ED8FBB120EA361B3
                                                                                                                                                                                                                                  SHA-256:66555A00B12C94F26E97CF60606FB1183310C657BF4F46111AFF39F20D907AF4
                                                                                                                                                                                                                                  SHA-512:7610621301E1B7E021BCB9E534211E07865CEC313F80DE88B421E420370E47EAABF52A6D525BAE37DF34EA0D75EF6A500B5FC503651CE0188D0E97878871E61E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kK../*../*../*..e_.,*..&R\.)*..&RJ. *..&RM.**..&RZ.&*../*..*..&RC.)*..&R[..*..&RX..*..Rich/*..........PE..L...A..e...........!................#...............................................o.....@.........................P.......L...d....p...............\...*..........................................h...@...............\............................text............................... ..`.rdata...O.......P..................@..@.data....T.......L..................@....rsrc........p.......J..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FlBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:64C52D50D8C92688CF7B001B50437C79
                                                                                                                                                                                                                                  SHA1:B8C60174D3147E56D790FEFF45989D67A5118374
                                                                                                                                                                                                                                  SHA-256:01393A2AB5659B832BFD75FB4F311A4404851FEEA079653997A0D7A6A004ABA3
                                                                                                                                                                                                                                  SHA-512:63CC7BC5BE3A07813EF1A6285C1070799C7B95347E7E37938CF6BC8DE5216CBD5075FF88A890FFAFDA3398CC03A4433C03D18132536AC21C0B31BD9D413717BD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...D...D...D......D......D......D.......D......D...E.u.D......D......D......D......D.Rich..D.........PE..L......e...........!.....>...4...............P......................................B8....@..........................I......d*.......`...............v...*...p... ..PS..................................@............P..$............................text....<.......>.................. ..`.rdata.......P.......B..............@..@.data........P.......<..............@....rsrc........`.......D..............@..@.reloc...)...p...*...L..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FlImgFile.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:996A97B9A60144C7E72B9B9EE5F1541A
                                                                                                                                                                                                                                  SHA1:8CF5B6444BD6D3BAEEE2FF11E8EE6722C6092399
                                                                                                                                                                                                                                  SHA-256:7417C4F698DC2B5AA5745772563E5DA6709C6205980BC35F548A6D3B33648578
                                                                                                                                                                                                                                  SHA-512:CCF28C28A2D09F0EAF5C375116D519B3AE4EFB003F5A4752C9CC4D135AC45A2D95CBF18906FB254D1FEAFDEE68354B4604EF8359EEDA219DE1AD56AFFF1D2A82
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...6_..6_..6_B.._..6_..._..6_..._..6_..._..6_..._..6_..7_[.6_..._..6_..._..6_._..6_..._..6_Rich..6_................PE..L......e...........!................m................................................`....@......................... )..........x........................*......(=......................................@............................................text............................... ..`.rdata...P.......R..................@..@.data....)...P.......(..............@....rsrc................F..............@..@.reloc..pO.......P...N..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FlRestore.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C53D0D6527A89589FC5BAAE33033F716
                                                                                                                                                                                                                                  SHA1:C2BC070A727B4B90289688F0C34B21AA43AD4F81
                                                                                                                                                                                                                                  SHA-256:1987C7F4D02AD4FEA9CD26553F3D8030A78EC3F7B8560AC5D6B33413E9A6CCBD
                                                                                                                                                                                                                                  SHA-512:38114B7FB5F12CF633F2F35F26280E4DBF157A32F0BF18658C03138E455039810E898E07CAAB438C74D4EBB8138F009771CA8871AA2CF12134F1C6100681B918
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r[.P.5.P.5.P.5..\..R.5.Yk..T.5.Yk..^.5.Yk..Y.5.Yk..A.5.P.4...5.Yk..[.5.Yk..Q.5.NA..Q.5.Yk..Q.5.RichP.5.................PE..L......e...........!.....................................................................@..........................m......PV...........................*...... ....................................9..@............................................text...o........................... ..`.rdata..............................@..@.data...x....p.......b..............@....rsrc................h..............@..@.reloc...............p..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FlSearchImg.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3B8A52B0EB69908CF4EF1AC579066DDE
                                                                                                                                                                                                                                  SHA1:847D2019BA44C9B5B26BCAC22E9AB03DFEC5F63D
                                                                                                                                                                                                                                  SHA-256:1F7D5D64FB5E4BD4E5F9361E8FEA63BB2EA1EB99DF51C6E01BF10E3D1D249C72
                                                                                                                                                                                                                                  SHA-512:4872862C3F700FCDE44C32EFA0CB895AEA4AEFB9CAD790D89F3EB8AA1EC275321EEBE32E06C4837B230B835810201569E7AC298D9803AD6339A9DA9853F5BE43
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c............MZ.....zY.....zO.....zH.....z_...........zF.....z^.....PX.....z]....Rich...........PE..L......e...........!.........F......................................................C....@.............................j.......P........................*..........@...................................@...............,............................text.............................. ..`.rdata...,..........................@..@.data...............................@....rsrc...............................@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FsDsReader.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:47375D924375CECB774BD05376795B35
                                                                                                                                                                                                                                  SHA1:310F5D2DEBE21C8031006BA760E3C455D065B7F8
                                                                                                                                                                                                                                  SHA-256:9F5B9FBB0AE1BADFD0101922EF8BABB0E866FF5D17A34ED35FE5F3F7F95C1C4B
                                                                                                                                                                                                                                  SHA-512:A2DC7D20B6C33AE91E884BBF14094E4F8C61D984E340A36A2328DCF83B05FC4E2A9593F0BBE6DFC5F61E40A5C78CA1DACD98C3885DA7294EC2E72206D40941DF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B7..#Y,.#Y,.#Y,.l.,.#Y,.[.,.#Y,.[.,.#Y,.[.,.#Y,.[.,.#Y,.#X,.#Y,.[.,.#Y,.[.,.#Y,.[.,.#Y,Rich.#Y,........................PE..L......e...........!.........@......e........................................0............@.........................@...........P........................*... ..........................................@...............t............................text............................... ..`.rdata...'.......(..................@..@.data...............................@....rsrc...............................@..@.reloc..>.... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FsEmReader.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B5948771B94DC0D744A329D9D14420C0
                                                                                                                                                                                                                                  SHA1:F96B94A9E0A0F146A59E247E3D02109376AB1D02
                                                                                                                                                                                                                                  SHA-256:C6C5FF07538BE6AA485E247DBE057BB94F8C884BBE7F2091A847EE99DCCDA018
                                                                                                                                                                                                                                  SHA-512:4FC103E92029F2CE4EBB370633C56AAE67584D083AA2D3BAFB4BCF1AB8DD69DCF94AA1B755CA8188BF84E0106CE5EBB8E3988BB22EA5287BD4D7A625D1543153
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z...;e..;e..;e..t...;e..C...;e..C...;e..C...;e..C...;e..;d.5;e..C...;e..C...;e..C...;e.Rich.;e.........PE..L......e...........!.........b...............................................p...........@.................................d...x....0...............>...*...@...#..p...............................p...@...............L............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc........0......................@..@.reloc..F-...@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FsParse.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:289BC447D00FF31CEF63CAF427203BDC
                                                                                                                                                                                                                                  SHA1:43593EF6CCE6B3CDE7911EF47E8B85423C4D1169
                                                                                                                                                                                                                                  SHA-256:50CFFC446510D2736DA47BCFA21A3CE1E67EB9158AD6688D700760B4456B9965
                                                                                                                                                                                                                                  SHA-512:D4CA7BC067FE7977F8F3399E2894169F8214243B0E6B154D72BFFFF9B4E2A242C31E27080DE52C6D13A137F5421BD3877643D77561E534E51502C4D861CADEF4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tI..'I..'I..'...'H..'@..'K..'@..'G..'@..'@..'@..'@..'I..'...'@..'A..'@..'H..'W..'H..'@..'H..'RichI..'........................PE..L......e...........!................................................................k....@.........................@:..f....0..d....P...............L...*...`..........................................@...............\............................text.../........................... ..`.rdata...Z.......\..................@..@.data...X....@.......&..............@....rsrc........P.......,..............@..@.reloc..x....`.......4..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Ftp.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:88D8ED03294B532A48D6B8FB66D4104E
                                                                                                                                                                                                                                  SHA1:F23D8743CD610364836CF21F8D014118BBD067F2
                                                                                                                                                                                                                                  SHA-256:06CA372FB7C01F74B1FF4441535AE7495BAC7D026DBA39EAF9E6735E746D1A29
                                                                                                                                                                                                                                  SHA-512:47F105208F487506F8514FDCFB0CB77FFCF297415F6104319D87863E484F3D12FC58035F44E51A0AD2C0829F4D5D68B71BDC476135442E52F6794A4771B9F2A8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a=b.%\..%\..%\..,$...\..,$..7\..,$..I\..,$.."\..%\..@\..,$.."\..,$..$\..;...$\..,$..$\..Rich%\..........PE..L......e...........!.....R..........)........p............................... ......,.....@.................................\...P........................*......<....q..............................X...@............p..l............................text...#P.......R.................. ..`.rdata..!I...p...J...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FtpStorage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:ACB53143600B236FA944F9EFD9F67B82
                                                                                                                                                                                                                                  SHA1:B733F61A7D51C288741DCA3870D4689305C71425
                                                                                                                                                                                                                                  SHA-256:23CA0C87ED9B2705E2900706BC8A048F45BCB2712EB9D4ADE6808AB583FF6F0C
                                                                                                                                                                                                                                  SHA-512:B10B7A3B7811FB0EF282B8513C84ACAFC6653B5347755E2D7EFD88AEC7870249C684D6B4D9381E248C806BE6A332D576DEA5B968AD8387EFCB64E7E3EFD699D7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x...x...x...x...x...x...x...x...x...x..x...x...x...x...x...x...xRich...x........................PE..L......e...........!................1...............................................d.....@.........................`...n...pq...........................*..........0................................Z..@............................................text...O........................... ..`.rdata...u.......v..................@..@.data...(............n..............@....rsrc................t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\FuncRun.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2F776C52668D42AA52635A332CF170F7
                                                                                                                                                                                                                                  SHA1:5C6740A3C6B4A8009EA42C88F6E27A8807E6ECC9
                                                                                                                                                                                                                                  SHA-256:DB62895FEE16CF9DC3F1EE35F94F8BB5711192A7E136929AFFD087A0610E223B
                                                                                                                                                                                                                                  SHA-512:C92C26E79A8AB2A5C4A410B38140045D60E3A14D97426FAEE99C6D60CE307D77961B6817214EB6D195739D0CC433E5EB736652FBACF6135A8D45684D5EADC35D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0..0..0....N.1..9.M.2..9.[.&..9.\.8..9.K.9..0..[..9.R.7..9.I.1..Rich0..................PE..L...[..e.....................H......g.............@..........................P...........@.................................h...d....0...................*...@..0...................................p...@............................................text............................... ..`.rdata...5.......6..................@..@.data........ ......................@....rsrc........0......................@..@.reloc..d....@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\GameDataBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:78E25F9FC1E21FBBE85B1C7CBE387F05
                                                                                                                                                                                                                                  SHA1:E7AEF4502D7EC0A0FC0208002BEB1F2A91B315C0
                                                                                                                                                                                                                                  SHA-256:FFFE2AA2C3E8CF671A7813914A78EBD66BE6389CCD5CC696969F36076A2CD94B
                                                                                                                                                                                                                                  SHA-512:E5561530CD604639BFAA304BEB094C8DDFE86B3BF06B3FF9D55AA288B506E9B21E8144E393CF853BBE549C17BBECE7C6E56F66CBEACDB422C21DDAEB18D4598D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.R..f<..f<..f<..)...f<......f<......f<......f<......f<..f=..f<......f<......f<......f<.Rich.f<.........................PE..L...Z..e...........!......................................................... ......cJ....@......................... ....................................*...........................................i..@...............H............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..H&.......(..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\GetDriverInfo.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:482D2DBAAC351B014B01F9A5BB3BCC57
                                                                                                                                                                                                                                  SHA1:54E585CF4E0DB2B6F69369B557EDBDF54C61A2C5
                                                                                                                                                                                                                                  SHA-256:E8C8537A94F1EC3B044C8680B381425A51ADDA34CE56572E6B14C1C8EE677B7B
                                                                                                                                                                                                                                  SHA-512:46C5949D610757A57017B3759C73ADB7C0A1F897A73844118EE65E5B4D0D92BB93EF544DEC5A17D3468F1D68CA7AF0877A2913540BD2A8ECD900E21748F15195
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f..f..f......f.....f.....f.....f.....f..g...f.....f.....f.....f.Rich..f.................PE..L...@..e...........!.....&..."...............@...........................................@.........................`R......`K..P....p...............L...*......4... A..............................xC..@............@...............................text...+%.......&.................. ..`.rdata..K....@.......*..............@..@.data........`.......>..............@....rsrc........p.......B..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\HotDrv.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:767001AD236F571BE1EEDC949896F579
                                                                                                                                                                                                                                  SHA1:68DB754E20455F4D790CB1BBC7BD8BAF1BEAEF59
                                                                                                                                                                                                                                  SHA-256:B1F0101DD0FB4DD055615B9B701FEDD4BC1654DAD511D222E62E67705B2AD944
                                                                                                                                                                                                                                  SHA-512:4EF9382F537524431EA7D1DADC7C671CCA8E63C4E97FDE08030A852B80E41B75009206D6A698D8DD30DFEABE98CCC1850C5B3DF0333DB63E904DD16676B268BA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..7~..d~..d~..d.rd|..dw.qdy..dw.gdq..dw.`dy..dw.wdy..d~..d...dw.ndy..dw.vd...dw.ud...dRich~..d................PE..L......e...........!.........~............................................................@..........................e..e...$X..P....................j...*...........................................J..@............................................text............................... ..`.rdata..Uf.......h..................@..@.data........p.......T..............@....rsrc................X..............@..@.reloc..4............\..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImageFileInfo.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EF9A7547D3E54ECCBE56FB4E3ECD3155
                                                                                                                                                                                                                                  SHA1:EA900C49B17B225E9AEE10F17D7191AB436FB4AB
                                                                                                                                                                                                                                  SHA-256:F92C355F928BFDD418C1B91A2A97E75F4DF5700B72ACE0A594DDB658EC668AF0
                                                                                                                                                                                                                                  SHA-512:DB79ABA35017E9608EC54EEC0A7E7DBF785ADA3FC5B38B18F3F829D2F04BD06A7C29F521D83DD293CE4EC964593CCA61AEB6AC3993ECF244D69E38D958915694
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H.........x.$......'......1......6......!.............8...... ......&......#....Rich...................PE..L......e...........!.....h...h......:d..............................................,.....@.....................................d.......$................*..........................................P...@............................................text...?f.......h.................. ..`.rdata...H.......J...l..............@..@.data...8...........................@....rsrc...$...........................@..@.reloc..z...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImageMerge.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E654FF2BE0F55AA08D5BA581A1759783
                                                                                                                                                                                                                                  SHA1:4773DA9269ECC1694142D7EDBFE0CF4431ECAFE4
                                                                                                                                                                                                                                  SHA-256:DBA1122298AB5FE72B0B959782D983C8B43F001FABE7B76430D50F501D666A7F
                                                                                                                                                                                                                                  SHA-512:CF6F36D2B08BFA52CF33EFBBFF866F3B8F435A4F4F9C15F8FB84999DAB60C69AB79937019B56F66D97B72C40C958126EE9A047590CD1A914DCC228F5BA69B6E3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..#vnopvnopvnop.!.pwnop...p.nop...ponop...p{nop...pgnopvnnp.nop...p.nop...pwnop...pwnopRichvnop........PE..L......e...........!.....D...d......S........`............................... .......d....@..............................................................*.......m.. d..............................pI..@............`...............................text..._B.......D.................. ..`.rdata......`.......H..............@..@.data....j.......,..................@....rsrc...............................@..@.reloc..6............ ..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImageName.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C454FDE543123A23BC9F61ED42B0711C
                                                                                                                                                                                                                                  SHA1:700CB5C48588EC58D2CA28E6C3177C34E93D36C9
                                                                                                                                                                                                                                  SHA-256:C064E9A5D2478D7603BDCEAF59F0939F4EA0E131F8404B8C6EB9A4EB6DFBC160
                                                                                                                                                                                                                                  SHA-512:996D5AF78287BAC3EBBAEDF93CDA7FE219EB7BE7DCE54401705ACE84E01F579973D831A97C691896E16904900071328D848EEE41DA6126B558AB726E8566A7CB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?/.[{N..{N..{N......zN..r6..yN..r6..tN..r6..}N..r6..pN..{N...N..r6..zN..r6..zN..r6..zN..Rich{N..........................PE..L...8..e...........!.....p...:.......t....................................................@.........................p...........x........................*.............................................@............................................text....n.......p.................. ..`.rdata...(.......*...t..............@..@.data...<...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImageSh.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5B3CF9568F67B27CAF772268047D32AA
                                                                                                                                                                                                                                  SHA1:75F4218BD9D895582400A432DB3D3C81B82D7CA0
                                                                                                                                                                                                                                  SHA-256:82901D64767C47A44D99860BEFC91FDBD1CF17FA5DF4FCB8685EF136A4F5AA9A
                                                                                                                                                                                                                                  SHA-512:896512B7ACF67A767B845C4D325DCF73538B0A912D8B39BC716331533699728FE386677200E97CD48E0E9BE18793A92340174C8B504B65E0495E236E74A5B05E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R].R].R]...].R]e..].R]...].R]...].R].S]..R]...].R]...]..R]...]..R]...].R]...].R]...].R]Rich.R]................PE..L......e...........!.........................................................p......._....@..................................m..........(............F...*...@..|(..................................@...@...............D............................text.............................. ..`.orpc...<........................... ..`.rdata..I...........................@..@.data...8............p..............@....rsrc...(...........................@..@.reloc.......@...0..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImgFile.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7445879C43B9DB5A5CE76A06CE181A38
                                                                                                                                                                                                                                  SHA1:71AF104DE79C368F4A53C4A6CE974FACF5E61D35
                                                                                                                                                                                                                                  SHA-256:E730811E28FD3CC42399C7D2C89BA435BD2FE3488909FEA1A8CBF240117C65BA
                                                                                                                                                                                                                                  SHA-512:15ABF8ACC94EC9D151A40D6AAB4D704D1EDD919C5335C9750812FB55ADE66F9757B1D22680E05346EE9EFFEFA50F4F3B663D0C2486D13847BADA3CDCEA321655
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+e5.o.[.o.[.o.[..K..n.[.f|..h.[.f|..b.[.o.Z...[.f|..y.[.f|..i.[.f|..g.[.f|..n.[.f|..n.[.Richo.[.................PE..L......e...........!.................................................................,....@..........................h.._....Y.......................z...*...........................................V..@............................................text...~........................... ..`.rdata..O...........................@..@.data...,....p.......V..............@....rsrc................j..............@..@.reloc...............n..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImgFileHlp.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0E93FF1EAB671D2820BFC3C068A8AA99
                                                                                                                                                                                                                                  SHA1:683FEBE21E62E9C4AEF48F2188A714EBC79FD841
                                                                                                                                                                                                                                  SHA-256:66F9BFB75215EA1A87CB8CF7BC980BF8ABB4C64BC6B5863433ACF35A25DC3078
                                                                                                                                                                                                                                  SHA-512:42ADD48D0D274B88F7DEE43A737DC2F979AA1624903A167C3ADE6C3901789820BBCD0C8E904A6BD1F59D9274BF5F0F56FA9CB99F86370840D07F11A8EDF4D23C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."sy.f...f...f....]..g...oj..d...oj..h...oj..o...oj..m...f.......oj..h...oj..g...x@..g...oj..g...Richf...........................PE..L......e...........!.....B...0......~8.......`............................................@.........................0d.......O..x....................v...*......x...Pb...............................0..@............`..(............................text....A.......B.................. ..`.rdata.......`.......F..............@..@.data...$....p.......L..............@....rsrc................R..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ImgFileHlpOther.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B3B8848281DC60862DA9A65048F6B5A7
                                                                                                                                                                                                                                  SHA1:5F3B7161A1221F93BDF67AC883F91B5EA43B9E08
                                                                                                                                                                                                                                  SHA-256:67CFB86A0FE94F961131D82EC1D1915919A741FA12FC26827FD4E3AF6A3C25E9
                                                                                                                                                                                                                                  SHA-512:AB6C52E654A447920181D8AF55BF86EF52BD6E36630FEE2068FA7C0B0DD9C508602A11AAE7F40B003EC0A58A2C52B71A0A9DE60F680C5FEC09F39D1045B29A98
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.....@...@...@......@......@....D.@......@...A.w.@......@......@......@......@.Rich..@.................PE..L......e...........!................................................................bE....@..........................M......lB...........................*..........................................`#..@............................................text...G........................... ..`.rdata...].......^..................@..@.data....!...P.......B..............@....rsrc................V..............@..@.reloc...".......$...\..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\IncTaskChange.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4482955FF45B98CC3C277717E7CF624F
                                                                                                                                                                                                                                  SHA1:27241D8AF1231ACAA3E2340D156D58FA76571E34
                                                                                                                                                                                                                                  SHA-256:BEC0BDD614DE66FDD5AA47CC5561CE69EAAF9E82C5977F2C71246A774532D1BE
                                                                                                                                                                                                                                  SHA-512:5CCCC0B561DA71DBA78231ABF57960EBCFC13FA919170D1DAAFD1AD3F9BFD0CA2A875479A4597B1730E2D7D7CE13395CAFC5EF7CC6AFFCCBE2714010A51E7433
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'..'..'...w.&....t.$....b.)....e. ....r. ..'...Z....k./....s.&....p.&..Rich'..........................PE..L...:..e...........!.....l...`......vo...............................................4....@......................... ...........P........................*.............................................@............................................text....k.......l.................. ..`.rdata...J.......L...p..............@..@.data...............................@....rsrc...............................@..@.reloc..j...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\InfoForSetup.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EC514E24309D0DE21AA3014E8108F73B
                                                                                                                                                                                                                                  SHA1:30242380A47404457027CF9C9988121513E6E47B
                                                                                                                                                                                                                                  SHA-256:66819FCCD48BB19A088FFCDE34EE0738F28B31AB06A8D6B13A438E4844EC4FF9
                                                                                                                                                                                                                                  SHA-512:C004D913D23F3795FB85C0FE2CBA6F187090A14C828F3876C1592ED47D1B6602F72D6DAD33DED03E92A5725CC460EF77B62D67665EBC0DB71091611C3AA448D4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..D..VD..VD..VMp1Va..VMp VU..VMp6V...VMp&VA..VD..V...VMp?VF..VMp$VE..VRichD..V........PE..L......e.....................N......m(............@.......................... ......(.....@.....................................<........................*..........@...............................`...@............................................text.../........................... ..`.rdata...(.......*..................@..@.data...............................@....rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\InnerBuy.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6FFAE28C57C8F98CD38B902850B0FF8F
                                                                                                                                                                                                                                  SHA1:ABA9F097C03DF3872E703A4C9B079459AE447177
                                                                                                                                                                                                                                  SHA-256:C42A5C51F676A4521C1AAE499433F1A485BEC84E0BC586EFAF46E8FA721D6959
                                                                                                                                                                                                                                  SHA-512:F6FA28950BED49399B4F8D616EEE65080FD03AFFB916AC47A2D22C4DA12A11EF5BC2C29F88417F107B1CF320EA2468DF53590782CD5F6AB5A15E5594F586DA91
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......5...q...q...q...x.E......n..p...#...}...#...v......s...#...Q...#...u..............u.......x...q...d.......p......R....).p...q.A.p......p...Richq...........PE..L..._..e.................V...<...............p....@..................................t....@..................................^.......@..(................*...0.....`...T...................X...........@............p...............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data........ ......................@....rsrc...(....@......................@..@.reloc......0......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\InstallBoot.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:61AADE7125B1FDCB94CB94212D4665FF
                                                                                                                                                                                                                                  SHA1:DDE0B006D9D83C8BD95C666ADE536C11BB949473
                                                                                                                                                                                                                                  SHA-256:F02381B4887C31817D6569ED340DC467CDA7EAC7213CD74A1243DA5F7E01812C
                                                                                                                                                                                                                                  SHA-512:6567962B3EED9CFE808500EE9878E455202C4F33961AB161B2C928EC3EE4485B51DB88092BE7D10AD409632E5909B774110AFECA7FD4AC42BA4C57F86F7C1A9D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6-.BWC.BWC.BWC.K/.bWC.K/.RWC.K/...WC.K/.KWC.BWB..WC.K/.@WC.\..CWC.K/.CWC.RichBWC.........................PE..L...z..e.................r........................@.................................,.....@.....................................P.......@................*..........p..................................@...............4............................text...,q.......r.................. ..`.rdata..j(.......*...v..............@..@.data...............................@....rsrc...@...........................@..@.reloc..b............t..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\JsonTransfer.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7950A24C84A8800EE3B4B77461354B02
                                                                                                                                                                                                                                  SHA1:D5AC88B23E2C124660B9952BC78CE694A2F80729
                                                                                                                                                                                                                                  SHA-256:3223BB792ECC4B00DE8FB168DEF2B0F66D5BFD3F49A19C530323EF6295F8716F
                                                                                                                                                                                                                                  SHA-512:48235AB9379D460EB795A63D5D204C0FA99903E70AA8B1A2D78D2A456090925D53FB9E11B14520D65D605B29EF62C841890A2AA8EE8CB4263722B9E475457EC6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........}...}...}...2+..}....(..}....>..}....9..}.......}...}...}....7..}..../..}....,..}..Rich.}..................PE..L......e...........!.........r...............................................P............@.........................0...J.......P.... ...................*...0..........................................@............................................text............................... ..`.rdata..zX.......Z..................@..@.data...4...........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\JsonTransfer_2017.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:17DD0A421EBAEF6BED37B2FECC1D0309
                                                                                                                                                                                                                                  SHA1:4F205B6D54C6FEE497121D917F872361F6BC6610
                                                                                                                                                                                                                                  SHA-256:C1B7C011341CA89CC78A886EBD9B35035A3303DC1899BB79E1BC9960A31EBE24
                                                                                                                                                                                                                                  SHA-512:744AAD4DD58C65948068564FBEE4B78B320FDE054DB20AF1E78EDB59B5A5B8CBA286F8F6AFBA8CFD75FB761941AF8A8103BADBF422F909AC76B036765B2FCA22
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I.............f}......v.......v.......v.......v......=.%.............Hw......Hw......Hw......Hw......Rich....................PE..L...|q.e...........!.........x......x........................................`............@.............................L............@...............,...*...P..........p...........................`...@............................................text............................... ..`.rdata...].......^..................@..@.data...d....0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\LastApp.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0F3B71D0FA474D73AFF7DE9CDF842732
                                                                                                                                                                                                                                  SHA1:7990F81C60B8AB722C5AD7367F69C85106BE5ED5
                                                                                                                                                                                                                                  SHA-256:5055DE34114F55B1BFAFBBBDA68EC60C4291109780B9C197557B7C222C9A4E09
                                                                                                                                                                                                                                  SHA-512:AFEAD4310E0D994D212C9E2BA1C783382FD8A434C3422D5D58EED998F9DC71F3583CA98480CEC776B0372DDC9F04FD48A2008EE14CE7AED73D65D05663CF5868
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version='1.0' encoding='UTF-8' standalone='yes'?>..<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level='asInvoker' uiAccess='false' />.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />.. </dependentAssembly>.. </dependency>..</assembly>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\LibraryManager.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E88908FC8A4D5F11CDABFAD8D186DFA1
                                                                                                                                                                                                                                  SHA1:28B8ADC625C720CE759C8B5C55374DB2144DF9DD
                                                                                                                                                                                                                                  SHA-256:9C673DE77F573E2AFD570EE78EEE82B1DDC6B454E6078F22C2A9F9459603237C
                                                                                                                                                                                                                                  SHA-512:F1569D011FD9EF6942C222672420A829664A8394B48F92E381E9C731E599729F1F6DE8B2DC5E427694AE99CB7880653D1713C7B132639B78343E91A14CD664F8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jr^............QD.......s.......s.......s.......s...............s.......s.......s......Rich............PE..L......e...........!.....D...&.......K.......`............................................@..........................x..m....m..x....................n...*......(...Pa...............................c..@............`..4............................text....C.......D.................. ..`.rdata..]....`.......H..............@..@.data...(............b..............@....rsrc................d..............@..@.reloc...............h..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\LibraryProc.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0D889654D6F4A8DE9406F6E023862840
                                                                                                                                                                                                                                  SHA1:F66A6273113A13D6742FF47870F2CFE27D02CBB7
                                                                                                                                                                                                                                  SHA-256:467D5CD9C2D86C951DD94D68E3C410FA4F88611EB128B8243B699BB4A5370327
                                                                                                                                                                                                                                  SHA-512:C6A81F7A7C7A9DEE9620278F0AE179763CEF173CD88EA6DA4F3DB266F7C31953B1FC8BF266AFACD33669156A5D7AE2FF9946497E436F87711647462B797FA2F0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H.e...e...e..~*L..e....O..e....^..e....Y..e....I..e...e...e....P..e....H..e....K..e..Rich.e..........................PE..L....b.S...........!.....t...,.......x....................................................@.............................k...L...........................X.......h...`...................................@...............@............................text...0s.......t.................. ..`.rdata...............x..............@..@.data...............................@....rsrc...............................@..@.reloc..N...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\License.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2ABA8C5230724D2B994527DAF410EB46
                                                                                                                                                                                                                                  SHA1:C6EBAD3695B38E8A1C482F953FF825743919B1CD
                                                                                                                                                                                                                                  SHA-256:E532343E6A3D522A1740E205560DCECF013B4D7472BA7D0DA40659E5CA9AAE38
                                                                                                                                                                                                                                  SHA-512:83903E0B15607F3675EFD45AB90A2FE0E9F7ACE273A180853C0EB5385AE777C6E8E47D0A06CF78237D641A9551031612EEF104EA6DE45F3EE0449CB6CEF4DF4D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.d*=..y=..y=..y4..y?..y4..y0..y4..y?..y4..y:..y=..y...y4..y8..y4..y<..y4..y<..yRich=..y................PE..L......e...........!.........>......y(.......0............................................@..........................V......\R..P....................`...*......,....0..............................HQ..@............0...............................text............................... ..`.rdata..-'...0...(..."..............@..@.data........`.......J..............@....rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Loader.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:29BC56F0D96AE2D9E1748F7D5F68EB52
                                                                                                                                                                                                                                  SHA1:3BA069976D2160A0F5B645686D8E32D62994CB22
                                                                                                                                                                                                                                  SHA-256:913678468942D5CAA99D8B8C7224E48EB1E667D4404E5E09048A7B794167B23D
                                                                                                                                                                                                                                  SHA-512:864BBAF472BB1F748DD08FCBCDDB4CB3635E9F23CF3C1D1DA20C85E91A3D90BDD83EBAB78483999652749B9D9ECFF7DFAF75F88A8A2A8CC7BE7CD8289048595A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........wyPu.*Pu.*Pu.*?..+Zu.*?..+.u.*?..+Bu.*...+Bu.*...+Cu.*...+wu.*?..+Yu.*Pu.*9u.*...+Ru.*...*Qu.*Pu.*Qu.*...+Qu.*RichPu.*................PE..L...=..e.................x...v......0R............@.......................... ..................................................d....0..H................*..............T...........................H...@............................................text....v.......x.................. ..`.rdata...|.......~...|..............@..@.data...............................@....rsrc...H....0......................@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Loader.exe.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:624E21D412FE9B592FE955126312C589
                                                                                                                                                                                                                                  SHA1:65408B8A2E208C71DD46F0DCEC56B66831A1D22B
                                                                                                                                                                                                                                  SHA-256:C1754566644D1105A6461B390C165436A1A22265C42D8479554226290215FEA9
                                                                                                                                                                                                                                  SHA-512:165C0CC36F4831A5F654D163E95101113DDFA9BB111A231FAC087883D961EB596389847DDF811EDAFAA1D159329C275DD4BB1787BDFD5E68E4B0F56623DD363F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>.. </requestedPrivileges>.. </security>.. </trustInfo>..</assembly>

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\LocalStorage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DBFC1A7ADC822D7803FA886F4C60ACE3
                                                                                                                                                                                                                                  SHA1:C86E723F007528B93DAA5FD898BF94CA1F42832C
                                                                                                                                                                                                                                  SHA-256:E870A9809593C480F8099BF8FD49CA0CB6C5F61E252DEAD6E539B3FB14B1C526
                                                                                                                                                                                                                                  SHA-512:265177626AC31CA28A5CA9BEDEFA101A173B5826CC20D7498E50059F15294A0CC12A49614B7D17528C34056607CE82CECFC662C62D92A6FE59ED87656C355A2B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0].DQ3EDQ3EDQ3E...EEQ3EM).EBQ3EM).EJQ3EM).EMQ3EM).EOQ3EDQ2E.Q3EM).EAQ3EM).EEQ3EM).EEQ3ERichDQ3E........................PE..L......e...........!.........j...............................................@.......k....@.....................................x.... ...................*...0......@...................................@............... ............................text...c........................... ..`.rdata..UR.......T..................@..@.data...8...........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Log.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:580C462F66D953049BD0ED0978300F1D
                                                                                                                                                                                                                                  SHA1:B8E58B083D160E6688E675A5457DD490B5C31FBD
                                                                                                                                                                                                                                  SHA-256:7048BB5DFCA82DB2A474488593C91BE4A0762CABE864B072A26E4460BB374FC4
                                                                                                                                                                                                                                  SHA-512:5FF6568AD19A2DF9EE107A2F73A59B926888352D494DB639173E723FE8CF3449A7CBCEB4B2BEE916F9D6DD9B8AB7641A7FC958C2BCB43766397BCE99BE38A099
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................,............................................Rich...........................PE..L......e...........!................. .......0...............................p.......m....@......................... >..q...\8..P....P...............6...*...`..x....1..............................06..@............0...............................text...%........................... ..`.rdata.......0......................@..@.data........@.......,..............@....rsrc........P......................@..@.reloc.......`.......2..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\LogSys.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BA57BE04E0A730C8168A73FC174F8DBF
                                                                                                                                                                                                                                  SHA1:BCDBCB5C57CDC90565E5EEF6B9B408B7F3FB7B78
                                                                                                                                                                                                                                  SHA-256:7F656D54F3FF291331F0DA61B1EFECAED3A7043DF388CDD4530281A48F9AA215
                                                                                                                                                                                                                                  SHA-512:AFEF19CF43BCADA9DCF4EA35C1722BFC143AE5DDD422555075D43BF00040ABEF3E8020ABD6D1371DDE1F52BF72A2EF9D61D5C8423804A5053FF470D87078F830
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.x.v...v...v.....w......u......x......|......y...v.........}......w......w...Richv...........PE..L......e...........!................................................................N....@..........................?...............`...............P...*...p......`...................................@...............4............................text.............................. ..`.rdata...p.......r..................@..@.data...4....P.......2..............@....rsrc........`.......6..............@..@.reloc..f....p.......:..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\MSVCP60.DLL (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CB21D826D9C39AED19DD431C1880F5DE
                                                                                                                                                                                                                                  SHA1:6EAFCC2FDFDF73ABEA334AC7AFB903829F6FF2A6
                                                                                                                                                                                                                                  SHA-256:F1FD0F1A54F196B19A6F21044092C89C02353DAD173C236D80F6474CB8A7EA7F
                                                                                                                                                                                                                                  SHA-512:D4223A0AD6118B1DAE8505AD4675F6E87E4FA9EBCA6FDBE2EE3F0EA868CED15F07FB5AE2D9A41D8992A9D41A9BBE4B16F7AC6EEB1C99324ED8FA3A8FC47AF150
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.T....................2...............................................Rich....................PE..L... ..9...........!.........`.....................x.................................................................8..D`......V................................,......T...............................................d............................text................ .............. ..`.rdata..0...........................@..@.data............ ..................@....rsrc...............................@..@.reloc...,.......0..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\MatchStr.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9F34D4A6052CC948403D5B527B310B77
                                                                                                                                                                                                                                  SHA1:73B639F7567AF73D79182973A9358C0B5BC975D2
                                                                                                                                                                                                                                  SHA-256:606A93915BCAA8082675A3062DEA28297D36DEECD94DE8329979F64A7F2224B7
                                                                                                                                                                                                                                  SHA-512:961A91F50386CF2CCF00BA9817049ACE0993BAA0001AA16A500C7131B435F3032482596D06169981EFBFC5ED64B20809A6B67378A9BED4AC9879BF59EAEAD27A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\..a.a.2.a.2.a.2..J2.a.2..I2.a.2.._2.a.2..V2.a.2..O2.a.2.a.2.a.2..X2.a.2..N2.a.2.3H2.a.2..M2.a.2Rich.a.2........................PE..L......e...........!.....t...........o..............................................<.....@..........................K..g....A..x....`...............V...*...p..\.................................. *..@............................................text....r.......t.................. ..`.rdata..............x..............@..@.data........P.......4..............@....rsrc........`.......:..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\MessageFactory.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B83D7E3BE632C65A313C0F74098E0663
                                                                                                                                                                                                                                  SHA1:97FD31860FA10FD78E918E0838485B6C645878CD
                                                                                                                                                                                                                                  SHA-256:59D7BF5C8DD80FD5C127EA66257E571B321F0C1316BE5257ACD99D9DDA9E9C77
                                                                                                                                                                                                                                  SHA-512:F9ED7FC92389EFE78B9B6CBF6E88879A8E3E4EE2CE1C547695088A231E514DB5C71CD9EFD92C2EC34C4BABA837046426AF07A2DE85A1C0D9D33A59D1A5504D6A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0..t...t...t.....~.w...}.}.r...}.l.|...}.k.{...}.{.....t......}.b.o...}.z.u...}.y.u...Richt...........PE..L...V..e...........!.........V.......N.......................................0......DU....@.........................P...w....}..x........................*.......0.................................. *..@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...A.......B..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Microsoft.VC90.ATL.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (502), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:69E6E75B8251A7749435E331E29912A4
                                                                                                                                                                                                                                  SHA1:6467C2F533D43AC6E9154CD4E4A0114CA820AEC8
                                                                                                                                                                                                                                  SHA-256:9A900C1D0801730B675A8C67048F80FDE41AF58D52C72D8545D4A405CD10F4D6
                                                                                                                                                                                                                                  SHA-512:847D7962AF49ACC5C1B8F4E01B917DF029971112163D8A5A42D4BF798B13FABB04E2BBA37257612C52588EE280B29ABB2DCECF02D4B8DB268BC0CF3CCC4B7482
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.ATL" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="ATL90.dll" hashalg="SHA1" hash="f0cf74c20776ac03e144833d21af0b288b9da01b"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Bv2ROMQw5/LTkLmljt9dlJ9XBX8=</dsig:DigestValue></asmv2:hash></file>..</assembly>

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Microsoft.VC90.CRT.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4F9ED5EFA4F7B75BCFE0F36C36EE5CB6
                                                                                                                                                                                                                                  SHA1:29F568508A65F5177C6044544248893A876A666F
                                                                                                                                                                                                                                  SHA-256:FF718390133B400EE679177B2902BBB918DB148BBB4ABABA03D0A1DF325B3303
                                                                                                                                                                                                                                  SHA-512:A94AA869B8420D3965FAD7B05E1E894E8CA00465CD8C2BE2AC135F44D0689AFA7257BB468C69B7BB33BBB036D6B66FBC693C964BF17A85A209AEEE9F8DFFC3CD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="e0dcdcbfcb452747da530fae6b000d47c8674671"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>KSaO8M0iCtPF6YEr79P1dZsnomY=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="81efe890e4ef2615c0bb4dda7b94bea177c86ebd"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Microsoft.VC90.MFC.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:17683BDA76942B55361049B226324BE9
                                                                                                                                                                                                                                  SHA1:594CE635A06029B7206CB8AC7D68883B122A07F9
                                                                                                                                                                                                                                  SHA-256:27C573D1DE24A2CEF2B2CAC0850BF079A02D478D54CF00617A1D2F08A17109F5
                                                                                                                                                                                                                                  SHA-512:5C0F1D2A0C054A3E26D579963A044DC1B32CBE307C54ACF167EEC194D3DE2525823570564844971B7764A7EF93C60956E4CE17D76A720EF3C6A114A17137180B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="f29de3b0fa14e6ff8c70e48921de5ad3cb433997"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>b027Nqjn5ZThKiqe1Lca8PqnYsE=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="0e22737c69b9bbee766f0c92263e2ccf8c82c72d"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="h

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Microsoft.VC90.MFCLOC.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (5023), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6439B46D6D9CB337DDF2D8E643455951
                                                                                                                                                                                                                                  SHA1:AD2D3C5E60DA82F66CF0561C22741EBBE3DEC39E
                                                                                                                                                                                                                                  SHA-256:81E13DC44E21FCA2B095E82C34294C199D37428F32DE36D5FFA6CD3B54F88D7B
                                                                                                                                                                                                                                  SHA-512:2DFD9080BC705D98C017824FC0E42EB9840F478529536D152876E48D700003301B78326C24C173A040864BF51B42B657AAF80A318D1CC82AEC05374D04894C73
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFCLOC" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="MFC90CHS.DLL" hashalg="SHA1" hash="f7e49d66e28ed50c4cb1b38b7f7cedf747df296c"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Im9J2o+5YxPWw4Al+IYL82rBB8c=</dsig:DigestValue></asmv2:hash></file> <file name="MFC90CHT.DLL" hashalg="SHA1" hash="7d0374f0a1c38c56c313f2240e18d97777f60bb5"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Microsoft.VC90.OpenMP.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1B2B5A8FA0AB8C76EC505F786A74CDB2
                                                                                                                                                                                                                                  SHA1:BD226191A48C1A268B5F57CDD1BBC10EC146AE30
                                                                                                                                                                                                                                  SHA-256:B189460384701BCC280C0AC3C9E007E705106D6B8AC8EE52E118036F496B3C1D
                                                                                                                                                                                                                                  SHA-512:B9A6ECB6F809880FF6FCA388F6B91CC362FB416D21D5A8EABDF7582A134E5408B82ED1E94E6E7ABA8D89C2F5F26AD08013AFB09C88314F52798BF8EBDDCDB27A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.OpenMP" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="vcomp90.dll" hashalg="SHA1" hash="0449830bf053b677b00100148918af34d3cb765e"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>hPU61fGgHh+hxNJrMiLhCVnevSU=</dsig:DigestValue></asmv2:hash></file>..</assembly>

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\MixImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FC092AA3B8E555CFB9D3AF4AB2DEB7D5
                                                                                                                                                                                                                                  SHA1:70D932EA62C95CA01562F02F0CB2B78B8913063A
                                                                                                                                                                                                                                  SHA-256:89812A873768F4688BA714618B6C4D810927A822D97BA628457CC1854650537F
                                                                                                                                                                                                                                  SHA-512:1B2E4B986796E8222686C73A8A57A706DAAB826941ECC63B01D172B6CA2422676C4590D8BA9DA6A435FF0F4E95469E097A57486863247293579877BC5C1D025D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o...5.n..f.6.i..f. .v..f.'.d..f.0.d..o.....f.).w..f.1.n..f.2.n..Richo..................PE..L...\..e...........!.....v...`......E...............................................U.....@............................g...`...x........................*..........P...............................hq..@...............0............................text....t.......v.................. ..`.rdata..7........ ...z..............@..@.data...............................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\Mom.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:386CB149DCFA03483F09A8CF8DC4C9A9
                                                                                                                                                                                                                                  SHA1:F7A00E8E1D28B089D63EB2AFC10475673439CAC6
                                                                                                                                                                                                                                  SHA-256:DA4246B98BF072534A8581BF2FBD1E189D5521A8C44FD154999300B331746E0C
                                                                                                                                                                                                                                  SHA-512:A5203F56DF5FAA3626058BC82D2C8358AA64E6F7FE74983B2C2070BD49558E75E18F822A81231687049AF27F9AB6AAF877871F3357D712936BDF49674E1C3C54
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y....z...z...z..5...z.......z.......z.......z...z..%z.......z.......z.......z.......z..Rich.z..........................PE..L...(.&R...........!.....$..........t........@............................... ............@.............................Q.......P.......................X........... E...............................T..@............................................text....".......$.................. ..`.rdata..1[...@...\...(..............@..@.data...`6.......*..................@....idata..............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\MountImg.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4D841C9C26D229023CA7069A93E542CD
                                                                                                                                                                                                                                  SHA1:687F2B10BA385050F477C882D8647FA89C098946
                                                                                                                                                                                                                                  SHA-256:458A937B30C6BE54B4AABACBCE83914E50BCF5791FB1F89811C10AD79A5176C4
                                                                                                                                                                                                                                  SHA-512:705F774689AB2BB4C81B9254074329E475355CF9703CEA6A5F3A785332C596F712C5FB24CF024C1F35DA7F8FA57F893BA49AFF71A373332A9CCA12F64586F14A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..O..O..O.{...O.....O.....O......O.....O..N.B.O......O.....O.....O.Rich.O.........PE..L...A..e...........!.........L...............................................0......D.....@.............................g................................*... ..........................................@............................................text...+........................... ..`.rdata..g3.......4..................@..@.data...T...........................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NASOperator.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B815CE5A7928A6948E27A30E07D91AB6
                                                                                                                                                                                                                                  SHA1:E14C3C0281B0C3A25535784BC00C9D3CF86BA3CA
                                                                                                                                                                                                                                  SHA-256:0DAEDF176E409141392CE196A14B73B716809F4FDEA19A6A09F73DEA9822761C
                                                                                                                                                                                                                                  SHA-512:6F7530E155C8D66F5F41969D42DA6F5F97D31FC5ABB6EB7AE61F42AAC5DF18F291D53ED71C88B2EBF0893459FA8842C0D4E29EEB9CB5296283DF178EE5457C22
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.................).......*.......<.......;.......,.........c.....5.......-.............Rich....................PE..L...v..e...........!.........D......K........................................0............@.........................@...j.......x........................*... .. .......................................@............................................text...k........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc...............................@..@.reloc..f.... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NASOperator.dll.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F45FEDFCCE4A78FD25EA62CE9C2F089F
                                                                                                                                                                                                                                  SHA1:FF2F255A5A9342F3B494B96BAD04F3687623F0A7
                                                                                                                                                                                                                                  SHA-256:355F202FFD0106F6AF1810742223CD92F96A63F0E4867D963152CB52B171653B
                                                                                                                                                                                                                                  SHA-512:01740F858AC78561F447710F00590F160E9FAEE7E7AC085FF4CCDDA0AC9A0147BAD8C810F52AE78CAD13B8DC81F6FD2869121BEB3ACB3BBC04A48861BBFB59A3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version='1.0' encoding='UTF-8' standalone='yes'?>..<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level='asInvoker' uiAccess='false' />.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.VC90.CRT' version='9.0.21022.8' processorArchitecture='x86' publicKeyToken='1fc8b3b9a1e18e3b' />.. </dependentAssembly>.. </dependency>..</assembly>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTDETECT.COM (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B2DE3452DE03674C6CEC68B8C8CE7C78
                                                                                                                                                                                                                                  SHA1:6CAAFF4D8A162BB1080036CE1A6D023AECDA36C3
                                                                                                                                                                                                                                  SHA-256:8F7186A71684DD114E89CC908ED9400192BC3A47FB288CCE4C5C27D0F5D3AFA4
                                                                                                                                                                                                                                  SHA-512:D21C0F9CB1219F14FB53E1B2307F271564F3D24E8E09EAB8B2F2D5799168A40DCFB7866D750140327BD85B21F36FEB7288E7236C9D57CE685087C4B895BC83AF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:fUf..f........fSfVfW.............f..f.........f.^.f.N.f.v.f.~.f.V.f.n...f.....fUfRfWfVfQfSf3.f3.f3.f3.f3.f3...f..&..f_f^f[..f]...............U..VWS.N......S.^..'.G.X.g..G..O..w..W.....w.[_^].U..V...N..n..v.....^]..S........f.EISA&f;.u.........[..U..fVfWfS.v.f...v.f...v.f...v.f.....v.f...v.f...v.f...v.f..f...v.f..f[f_f^].fU..n..fWfVfS..f.^.f.N..~.f. ...f.PAMS..f.^.f.N.f..f-PAMSf..f.N.f[f^f_.f].fU..n..fWfVfS..f.....f.CISG..f..f..^.f....^..N.f....N..v..V.f....V.f[f^f_.f].....VW_^......VW_^......VW....._^......VW.F..V..R...T..R...T..V...X..F..V..Z...\..Z...\..^...`......_^......VW.^...`.9V.s..4.v....9F.w..'..Z...\..F..V.RP.v.....=..t...........k.....V...X..%...F..V...X.%......F..F..V...V...X..F..V.).^...`..F..=..u.....F..V.Pj..v..v........F..V...._^......VW.F..V.).V...X..F..V...^...`._^.....VW.d....f....t....v....h....j....F....F....F....F....F....n....p....F....F....F....F....F....F....F....F....F....F....F....v..v..v..v..G........F..V..^.%....p..F..V.%.......n.....F

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSCopy.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F9E85A7871E66EDF898FDDF72853B385
                                                                                                                                                                                                                                  SHA1:BE6EEF07B3C318F905B1B9782630ABE7E7E87AF9
                                                                                                                                                                                                                                  SHA-256:10836532E3BB055C054D06101493155B2C4FED162C52EEFCC06794C0B3B304C8
                                                                                                                                                                                                                                  SHA-512:88975BA19245DAD4952738D1173C0CCF30BF827404182B41CF9F51888FD714E541E0EE8FB8D38985BCC92B4986114A40082B4EF6019FBDD65D954B5878AE334D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P.Q.>.Q.>.Q.>....S.>.X...V.>.X...^.>.X...Y.>.X...\.>.Q.?...>.X...^.>.X...P.>.X...P.>.RichQ.>.........PE..L...6..e...........!................&...............................................1.....@.........................`I...1...,.......................R...*......8...................................0...@............................................text............................... ..`.rdata..............................@..@.data....U...........f..............@....rsrc................4..............@..@.reloc...............8..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSFileSystemAnalyser.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:432D55D80CD877323D3CECFDB2CFB12D
                                                                                                                                                                                                                                  SHA1:08726FC23FD1DB8483D420CCF300B66DF584E4E7
                                                                                                                                                                                                                                  SHA-256:9D8A68488C1842589AEEC01183F0701EB563D19010A9DA3268FB4F630EFE9187
                                                                                                                                                                                                                                  SHA-512:047A12D68B4EC9B870B25FA9A0E1D0A957FA989ABE547BCF382F9475AD3B750DCF90EE6EE0165738924457B319EDA39975AA3AC82CF033402460D05B751DA3B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y..y..y...4.{..p.7.{..p.!.w..p.&....p.1.~..y..E..p.(.n..p.0.x..p.3.x..Richy..........................PE..L......e...........!.....f...^.......j....................................................@.............................W...$...P........................*..............................................@............................................text....d.......f.................. ..`.rdata...*.......,...j..............@..@.data...|#..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSFormat.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9A38273330B2E77557DD4D0E5AD6686E
                                                                                                                                                                                                                                  SHA1:49259ADCB20622A47666A0F72EAF8E2DD47D20B0
                                                                                                                                                                                                                                  SHA-256:32329988C7714DA48ED040D413495C4A7C42C8AB8E5025BFCEA6A4DD17FA053F
                                                                                                                                                                                                                                  SHA-512:30F5DB67B073D4332ED9A1EA10B955CD8814D8AA4B5E1E1281BF625FB381A4DFD57EF863FD169252B3DC84069A197708747A9A3CA82F66DA3E5E9390641179A2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.....c...c...c.....,.c.'...&.c.'...!.c.'..+.c.'..%.c...b.E.c.'..*.c.'../.c.'../.c.Rich..c.................PE..L...F..e...........!.....v...........u.............................................../....@.........................PP......LA..x........................*......|..................................X2..@............................................text...gt.......v.................. ..`.rdata...............z..............@..@.data....C...`...<...@..............@....rsrc................|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSLib.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EFF772A2A05016770B049F57F7514977
                                                                                                                                                                                                                                  SHA1:386D118E14738117746228859E8F49E934F3C733
                                                                                                                                                                                                                                  SHA-256:5F0E1D2A0731E730C18A50864D6F838685BEEF845EB83B9514C7C32B414D96CF
                                                                                                                                                                                                                                  SHA-512:E30B491A276C593AE6B4C732B2D4296D7975C6D38AE1838BBEEA63430505E7B42BE79BB1E4F9EC8467E7061014F199B4A02B906142FE57F0E7023BE2CA0AC60D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:G..~&.,~&.,~&.,.ip,|&.,w^s,v&.,w^e,q&.,w^b,v&.,w^u,y&.,~&.,)&.,w^l,a&.,w^t,.&.,w^w,.&.,Rich~&.,........PE..L......e...........!......................................................................@..............................R......P........................*..........p...................................@...............P............................text............................... ..`.rdata..............................@..@.data...Pe...@.......$..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NTFSUtil.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9B1D997829392439031F23E58C6A883F
                                                                                                                                                                                                                                  SHA1:55C6E7C7047966B1F8DE47189807C98E3D3CCEF6
                                                                                                                                                                                                                                  SHA-256:CC2EB47E5AC44661DBAA111B0F509826EB52A382B10193637471807709BF7646
                                                                                                                                                                                                                                  SHA-512:E385081AC2225EF849AC9FEADD08139B75A11D2B77C685920F1C8222B45EEC5AE45108611CAB43780C949F788FEAF73B9D53827EB4DC8146F6899B4EE277BEDE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............\...\...\{.H\...\.K\...\.]\...\.Z\...\.M\...\...\...\.T\...\.L\...\.O\...\Rich...\........................PE..L......e...........!................9p....................................................@.....................................x........................*.......K..0................................_..@............................................text............................... ..`.rdata...6.......8..................@..@.data....`.......X..................@....rsrc................L..............@..@.reloc.."`.......b...P..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NasDevice.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F5892BF84104933918080B69D7F0A9D1
                                                                                                                                                                                                                                  SHA1:8ADFB0E9AECC998EB7C0BA262DA5C2CA48D29F96
                                                                                                                                                                                                                                  SHA-256:05537F983B9A702752A3FAE066A46C0C279E45235DD01033FEA13D5C64665A06
                                                                                                                                                                                                                                  SHA-512:FDC965A42F53E89C0FB4CB956212043915F455F7FD8C37D081F3DE6E0A2F076973B27DAB2407490158AD91AF8855F59FD62F9800AFE3D16F410988E35AFF4E63
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................2...................................Rich............PE..L......e...........!.....@...J...............P.......................................2....@.............................h............`...................*...p...(..PT..............................x...@............P...............................text....?.......@.................. ..`.rdata..h....P.......D..............@..@.data...<_.......$..................@....rsrc........`......................@..@.reloc..8~...p......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NetDrive.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:268EC97741E5D4D7F5348C7AA7C3427F
                                                                                                                                                                                                                                  SHA1:66693831BC2449434769C4395D475443E82E7358
                                                                                                                                                                                                                                  SHA-256:CB87FD42384E45A962FAD65AA6C785A2BFF1B270845A2A4C7AB44A4BD3EAEF7C
                                                                                                                                                                                                                                  SHA-512:8E0EACF6CC6B6C2829046F37D70E16EF84DA5E51C1643F3AEA4EA56721E7469A618B9412603F9A6281A20F055598DDFCDC6494CA53710CF306475CF79887D11C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\...2...2...2.....2......2.....2...3...2.....2......2......2.Rich..2.........................PE..L...|..e...........!.........h.......P...............................................?...............................H......l>..x....................^...*...........................................1..@............................................text............................... ..`.rdata...9.......:..................@..@.data....1...P.......0..............@....rsrc................B..............@..@.reloc..F............D..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NetManager.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CCD6BED4C2B312C27ED8D40937FA446F
                                                                                                                                                                                                                                  SHA1:118DDB102C5472A059A7E59A748AAC152685CDF2
                                                                                                                                                                                                                                  SHA-256:561E9D6B6524E8D14C5A6AE6C13A0682294796EC1823887635BBCD62DB8D835D
                                                                                                                                                                                                                                  SHA-512:2E982B699667C7877D9CF319900297313AE20E456633FFFC048867D0C69DCC63A392125C96ED3EC68928A772EEE32E5CDCA4A678F49E0B387293896F767E2252
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m3A..]...]...]..C....]..t....]..t....]..t....]...\.).]..t....]..t....]..t....]..^....]..t....].Rich..].........................PE..L...u..e...........!.........N......................................................'....@.....................................x........................*.............................................@............................................text...[........................... ..`.rdata..b/.......0..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NoStopVSS64.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8A14E37E44BB0E75A0958D23546A2628
                                                                                                                                                                                                                                  SHA1:BBADC2135AB92C943799A47F2B3BCA126FA490FD
                                                                                                                                                                                                                                  SHA-256:CE869D65FF27FEFB75B094F4F1B79CB4858EE8C052434F805B0C2CB47C582E44
                                                                                                                                                                                                                                  SHA-512:760664A04EF967C2D23A9646578C40282C2049FB9908F473B62ABC64EB33176F600A8F792BCB4483ED342F91061C9C6C27C7380504C6488FCA9589390D1C3B6D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..!*.r*.r*.r#..rd.r#..r .r#..r..r#..r#.r*.rY.r#..r..r4..r+.r#..r+.rRich*.r........PE..d......e.........."..........*.......3.........@....................................-z....@.................................................t...d....0..H.... ...........*..............................................................8............................text............................... ..`.rdata...?.......@..................@..@.data...x'..........................@....pdata....... ......................@..@.rsrc...H....0......................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NotificationCenter.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:11D1CDF8CEF2F0251ED555B0951B70A7
                                                                                                                                                                                                                                  SHA1:3E95C3E4E8646C3D1DB6FB58E98E7CB2763CA78C
                                                                                                                                                                                                                                  SHA-256:8084B9B8443B2FB7CF8DAD825AB68C8FEDC916E3137AF7EAD8783056963B33E6
                                                                                                                                                                                                                                  SHA-512:5268932ED4359FF908A5AC50771F833CF0CE2B02CD9ED4C7CFF1D515E7C6C409BFC3C30D36F8CB585CB2A632838C2FF73A68164E87F95E42743D2182E6F35596
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h)...GR..GR..GR.F.R..GR.q.R..GR.q.R..GR.q.R..GR.q.R..GR..FR..GR.q.R..GR.q.R..GR.q.R..GRRich..GR........................PE..L......e...........!................%%.......0...............................p.......?....@......................... <..9....5..P....P...............<...*...`.......1...............................1..@............0...............................text............................... ..`.rdata..Y....0....... ..............@..@.data...`....@.......0..............@....rsrc........P.......2..............@..@.reloc.......`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\NtfsSupport.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:61CB6B397A69CD2416B1150BA52A6870
                                                                                                                                                                                                                                  SHA1:4605109252B19ACA29E9755839E807A7602D10B7
                                                                                                                                                                                                                                  SHA-256:80E7518B7834B496766997C6C95DF2EE4BB49A81183C1BB80136775E382456D5
                                                                                                                                                                                                                                  SHA-512:F09E8E6D027DC2A760CB424D51CD27CAA92126C51AE06FA31DF0F3A66416AB6121603C76310269D8889496B5C1ACA68706C37B89E14734FFE261A22412563BF3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,.y.....,......,......,......,......,...-.I.,......,......,......,.Rich..,.................PE..L......e...........!.........@............... ......................................B.....@.........................0v..,)...a..x....`...............T...*...p......`"...............................G..@............ ..@............................text............................... ..`.rdata..\.... ......................@..@.data...t...........................@....rsrc........`.......B..............@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBFVSS.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7820C310126DB904B2E8CC6A7C59B66B
                                                                                                                                                                                                                                  SHA1:00BFC23D37C78D678AD4FA88F2EB52D263F99879
                                                                                                                                                                                                                                  SHA-256:DFE5912C4E5E88513863BF4A99A6663F40AAF563507CF9ACE41D9F7429444058
                                                                                                                                                                                                                                  SHA-512:1CB7002C30A62A441B070CB1B59D92F4D35BC22562EEC96457D9DEC7C6CF111B571BE812C11E103FFD85DCEEF481E293F157C88EC3CA6C480C1FBCAE5619129C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.8.].k.].k.].k.%kk.].k.%zk.].k.%}k.].k.%mk.].k...k.].k.].k.].k.%tk.].k.%lk.].k..jk.].k.%ok.].kRich.].k........................PE..d......e.........." .....p...................................................`......=.....@.........................................p...........d....@....... ...........*...P..0...@................................................................................text....n.......p.................. ..`.rdata..,_.......`...t..............@..@.data... 7..........................@....pdata....... ......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBFVSS64.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:116C0C74DD12A7EED10BFB47D7B01765
                                                                                                                                                                                                                                  SHA1:D57E84C39486BD7DA72086B624E6412836ACD77D
                                                                                                                                                                                                                                  SHA-256:6665C79B7C89D7DC925BCE022104A941764EB67B99A3709464BFC37605502A30
                                                                                                                                                                                                                                  SHA-512:D4103F1842F61C1F94A282995A1F280EAC839FCE1AAE74B4569215BC3E2465030F0B5865A92FE702EEF2EBF1F9E4271D6F9EC5385336BC3CCB7E0FBE7BC50D41
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..!*.r*.r*.r#..rd.r#..r .r#..r..r#..r#.r*.rY.r#..r..r4..r+.r#..r+.rRich*.r........PE..d......e.........."..........*.......B.........@............................. ............@.....................................................d....@..H....0..L........*..............................................................8............................text...2........................... ..`.rdata..\?.......@..................@..@.data...x'..........................@....pdata..L....0......................@..@.rsrc...H....@......................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-console-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:893CCBB69C80F31E4113FEE262899556
                                                                                                                                                                                                                                  SHA1:6DB45D32CD313AE052FB6186573C5657852C3E80
                                                                                                                                                                                                                                  SHA-256:6B74E4CF18B07D6018E4C2AE561E9A37AB9E1FEBEFF06EAD44125CF1B070F372
                                                                                                                                                                                                                                  SHA-512:EFFBFFD7E9D24BE133F0AB888203A223DF8942D396C99C962132C2DE48CA8ED0218631C4B8D6BD29874C30643FB589D91E20132E27CD457CE5CA1ED8A68ECDD5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......A....@.............................+............ ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........;...8...8.......^*oX........d...t...t...RSDS......RI.:@c...x....api-ms-win-core-console-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................@...x...............7...q...............'...O...{...........................$...S...................B...e...........................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kernel32.AllocConsole.GetConsoleCP.k

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-datetime-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:84B028DA34AE530B30412096AA49553E
                                                                                                                                                                                                                                  SHA1:C10A7B6ECCE114ACCE7A2016190BFD4C8F8BF7BE
                                                                                                                                                                                                                                  SHA-256:9B84CE7988732EF57B8EA9288E5F2C68A30341FDEBF845B871AC855BA298ACAC
                                                                                                                                                                                                                                  SHA-512:46C69FBFFAB31FDE22D350879A8C2B2DBFF42D3502521D1BA56C63A770FE32B97BDFAF4693F7FC2BC470D2ADE6113F613B2BD909A5396F409A87BE258742FE7B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......:....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........<...8...8.......^*oX........d...t...t...RSDS./....8F.6.v.n......api-ms-win-core-datetime-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX....0.......................(...c...............T...{...................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA.GetTimeFormatW.kernel32.GetTime

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-debug-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:93782E5CEEC3E124D92286802903DBB2
                                                                                                                                                                                                                                  SHA1:A53A3E170F0A813CA7B78742B7008C39FF7A2BF2
                                                                                                                                                                                                                                  SHA-256:CC609900E84B3C3021FF54A587A442B5F0DB368D7853E687594D20997F1B7684
                                                                                                                                                                                                                                  SHA-512:EE33D33B94DDA7D9D4E6F93BC6C123A259DFB11724981023A98D56B583F47EBEE3D3E4D26AAFCC75FDE80AEF54C82DFD5396E37E5E6F03B9CC32344A2FA81B7B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDSA...^.O.m.0..6.....api-ms-win-core-debug-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX....0.......................(...\...............Q...p...................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStringA.OutputDebugStringW.kernel32.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-errorhandling-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:68AAF65EC761F8AC0E98DDC68A9A5E5D
                                                                                                                                                                                                                                  SHA1:86A5E5D1C10DC81F0C5B4C11F45DD26A66240CA9
                                                                                                                                                                                                                                  SHA-256:1387A4A748AA91C94C7605BB4A72F29C0AF6F3BC68C11E4B1CDC2E2DFE07E45D
                                                                                                                                                                                                                                  SHA-512:3B55CF4F47CD2477B880764B94646E65F1A54A8011DC75D5C38235AFD46F53F9D8C8410E70D20A89F019C2776CED0E5B592C390EF778A86CAE660ED4B0800A00
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0...........@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........A...8...8.......^*oX........d...|...|...RSDS.B...p.F..... ......api-ms-win-core-errorhandling-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........oX....N...................$...@.......................F.......w...................*...k.................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseException.kernel32.RaiseException.SetE

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-file-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B5A9FAB8A1FE14F47F953FB58B648FC8
                                                                                                                                                                                                                                  SHA1:A374CBB6D4B1DCADFABC2C3F7E7183E0472212BE
                                                                                                                                                                                                                                  SHA-256:00613EFA358764930353232F3442EBB934506051CD7D4EEC545E2DA35AA8546C
                                                                                                                                                                                                                                  SHA-512:AFB668DE538C2478202D16C3E877A4107D46A03A102C2C5D692C87BDCF904E9763869A3E317CAC214D8E4140D65123C1F52928DB4C826DD4CBCC11BE86A40B99
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!.........................0...............................@......e.....@..........................................0...................<..............8............................................................................text............................... ..`.rsrc........0......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDS..|...pO...;.^......api-ms-win-core-file-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................oX............K...K.......4...`...&...P...{.................../...\...............1...t...............&...O...................+...U...................9...^...................T.......................W...................E...p...............=...o...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-file-l1-2-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EB9161FD0B8137D2C43BBE7C646C8E3C
                                                                                                                                                                                                                                  SHA1:F41E6E7302B4BDE1281F583A5C4FD5FE7B03F2E3
                                                                                                                                                                                                                                  SHA-256:9E4F1D09A2471FF46B5BB2D9FDDB0BC04143398D14341D11423A7589796413F7
                                                                                                                                                                                                                                  SHA-512:F733062E46F46DBE85A21868AE0E5304E13C645C26E57D0CBA905BCD23C872B68F07A9813B4F55FCDDCF67475D649D5833D893B27D1FF3756D3F4DEEA0BDC785
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......?6....@.............................L............ ...................<..............8............................................................................text...,........................... ..`.rsrc........ ......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDS..W.r.nO...&.m.....api-ms-win-core-file-l1-2-0.pdb.........8....rdata..8........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02......................oX....0.......................(...\...~...........P...q...................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMountPointW.GetVolu

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-file-l2-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A9B1331617F9913210D4DFDE195D6929
                                                                                                                                                                                                                                  SHA1:6587BF0B9B89F212EE0E211CA55BBCE376FA7841
                                                                                                                                                                                                                                  SHA-256:EFB33877982C3D8001CF752B50BFD1E422327C274BDD1C843D762F629307F95A
                                                                                                                                                                                                                                  SHA-512:EAFE8157C510073349CFDDECEF6A713235B21A2C5F804A0E05F8CC2D1F1C82D9325C02C395448E029E5836DF72AA62C9026E93E9B5057A615A94EB0F95FF7A00
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...=/oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text...m........................... ..`.rsrc........ ......................@..@....=/oX........8...8...8.......=/oX........d...p...p...RSDS.....E..-~..H%....api-ms-win-core-file-l2-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX....v...................4...`...................@...z...............+...W...................,...]...................J.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.CreateDirectoryExW.k

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-handle-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F47D21315624368ED09D41021DF1D7AE
                                                                                                                                                                                                                                  SHA1:2FB5A76A88EA5712316A4FC42F66961AFC6590F5
                                                                                                                                                                                                                                  SHA-256:2BA31678405D74B791AFF50DA2671A82F7809130239E3F8C9D21DCE68C0786FA
                                                                                                                                                                                                                                  SHA-512:1442581523B070C722A76ABDC3FECA6A63CDB3EB2E4840FDECBFB756F05AB83E78DD268E577105507F2D9953455C9A0CCC59889FC5B94EDC7560768A0E299597
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......,5....@............................._............ ...................<..............8............................................................................text...?........................... ..`.rsrc........ ......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDSA..6.dN./{b.yXJ....api-ms-win-core-handle-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02..................oX....:.......................0...h...............!...\...}.........................api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32.DuplicateHandle.GetHandleInform

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-heap-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DD18F031EC7ADD5DB85E3CFA1D7DD735
                                                                                                                                                                                                                                  SHA1:FE13CC8E258D52A4A67A5551DE660BFDAD547632
                                                                                                                                                                                                                                  SHA-256:1771E45579E879B6465F4074FAEA12C2F6CDBBD24CA1A84ADFF4C6A54BA8FB4D
                                                                                                                                                                                                                                  SHA-512:440F05C296FDB58F0522FCC1D7103C9B33BDC382675E36251F233FBEBC66B54CFFB1B9124E1F345655763FF98511A6B64B9B351C8D2F30C46BF2503F2D983D6C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......8....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDS+.D+.XC......e.....api-ms-win-core-heap-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX........................H..............."...A...a.......................3...X...v...........................5...V...u................... ...O...j...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.kernel32.GetProce

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-interlocked-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:246545D6980FC2B2DC6222401F0E5B50
                                                                                                                                                                                                                                  SHA1:EB7CC27BCDBC2240BDB6FB7B2CF1DAFB4EC4950E
                                                                                                                                                                                                                                  SHA-256:CCE75BEF6208DE3B9018A950EB786FB2F194D3A61762483718066296DB268CA7
                                                                                                                                                                                                                                  SHA-512:43BA7BBB24C95E24E04B9385717A2751EC6A920F5907CC04C0620E025DE82982DDFA7B77E14D9494E8206D5444EB5A5F7DD3436D93FF8991BE550C00681F6F2A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......].....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........?...8...8.......^*oX........d...x...x...RSDS......J.A...N.6....api-ms-win-core-interlocked-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX....v...................4...`...........,...e...............5...l.......................P............... ...S.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSListHead.InterlockedCompareExchange

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-libraryloader-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:53621AC7D53BAA4414992AD17E6257A0
                                                                                                                                                                                                                                  SHA1:02A9B5DA969B50BFD677FA333B1AA82E481ED10F
                                                                                                                                                                                                                                  SHA-256:B469DC90D8A5D9FE77DA16A508DBDED6D4EB71AA925E452B8D5B9A70BEAB0A68
                                                                                                                                                                                                                                  SHA-512:7E5C373FA2D9013315405C61A832E931B8E79058BCECE73B89096094998E2F77B23DBA22DB11DC0FAADCCD38C343EA8E8776D508C6EE23E4055CA2814D79259F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......y.....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........A...8...8.......^*oX........d...|...|...RSDS.X.. .&E..g/).......api-ms-win-core-libraryloader-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........oX........................P...........2...]...................9...f...................?...f..................."...K...x...............&...U...................0...W...~...............................................api-ms-win-core-libraryloader-l1-1-0.dll.Dis

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-louserzation-l1-2-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:755B7023ED998486D9029F56C52CDD74
                                                                                                                                                                                                                                  SHA1:DBE7F8BAD220E3D000B0ABD18E4B36697F96E6E0
                                                                                                                                                                                                                                  SHA-256:08A74C3C146BFDDD7236C63E83E5CFB98EBE4595155A8954B50D1F0E60067521
                                                                                                                                                                                                                                  SHA-512:3590531682857E93C8A911E9B9D04F34FE5E49BC78A29804CF0C1CC974DC523C6D695837FB0DB6EE6D1C6093ACDADFF3B19768E751E9C7DBDDA232C95CDBD798
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......'.....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........@...8...8.......^*oX........d...x...x...RSDS.w..2FB...o..{....api-ms-win-core-louserzation-l1-2-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX....V.......;...;...............................F...m.......................=...i...................)...Q...w...................c...............J...y...............>...p...................<...h...................@...d...................0...g...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-memory-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A72A90D395DBCCEB4BE96938F01E5A96
                                                                                                                                                                                                                                  SHA1:D1ABB7BBCED6A8F7AE469FED37FD572DB6B7DC93
                                                                                                                                                                                                                                  SHA-256:D6F87EF0D75B45F58A9E6693E38D8C77A6F5FBC7793ED19954661DF5F76B90C9
                                                                                                                                                                                                                                  SHA-512:A5EB03E436D90BAF5F423109CE9A6CBC7C8870211F0B4D20B50F84BE8471DF9A55CC9C79DE3CCD8F119586C53A60BB93A74CDCE73D5D75379EBC3C7B03F25073
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......3....@.............................l............ ...................<..............8............................................................................text...L........................... ..`.rsrc........ ......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS....R.PE..EhC"......api-ms-win-core-memory-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................H...............0...W...................#...G...j...................0..........."...G...p...................;...\.......................................................api-ms-win-core-memory-l1-1-0.dll.CreateFileMappingW.kernel32.Cr

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-namedpipe-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EB40677933FADCE08384BAA315DF6A6F
                                                                                                                                                                                                                                  SHA1:4DB8CC6BE9B42DC1EBE68C5B638D17AD9561A866
                                                                                                                                                                                                                                  SHA-256:504C016932749167FE0178DDA460D1CCAE6E415DFBCD777220205ADF90F2C571
                                                                                                                                                                                                                                  SHA-512:44E47535526344B61B4ADA446ABB968B5AA369869347CDDB4D3E21A061A8DA3EDC61250AD9E49F874621D782AA492DB4770B0A94D070E5355D2207666818B17A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text...q........................... ..`.rsrc........ ......................@..@....^*oX........=...8...8.......^*oX........d...x...x...RSDS..12.l?G......>s....api-ms-win-core-namedpipe-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX....l...................0...X...................W.............../...Y...................7...................J.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedPipeW.kernel32.CreateNamedPipeW.C

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-processenvironment-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1C1396B44717F5BE5DCD06DEE6B49029
                                                                                                                                                                                                                                  SHA1:A1D149163E64CD4C9CB5124187DD8B4219279BD4
                                                                                                                                                                                                                                  SHA-256:851031C6DD624B3AFF9A0BC125F07D7ADA35DBD9D189934CB0641C663B69202C
                                                                                                                                                                                                                                  SHA-512:C0D3BB9B9A4274703B4697E4F92CC297BF2365E09768A42703AE8CA4C241FFE2E0ED70967FA5CE34320C8634BE31B4EED267582B8576C05D7F1C3E9DFE5FA350
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.............................G............ ...................<..............8............................................................................text...7........................... ..`.rsrc........ ......................@..@....^*oX........F...8...8.......^*oX........d...........RSDSX.n/c.%D.....C.}....api-ms-win-core-processenvironment-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02......................oX........................l.......2...o...............=...k...............@...y...............&...[.......................U...............-...V...............(...a...................D...{.......................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-processthreads-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:365BB8433FFFDEAF5EA19266823EE5DF
                                                                                                                                                                                                                                  SHA1:41E5C3B5B31D54FFD7B1621F8032D5D05771BB3D
                                                                                                                                                                                                                                  SHA-256:4C72124FDFDD3D698FC61C3A7098D8E6ED032DE3696C262F53D29AB2F0C9DC6B
                                                                                                                                                                                                                                  SHA-512:6321FB96B724D5750BF7EF493F381273EC55351A323118BEF67326848DA251C27EDD355C8DF1E06F35DFBE6C57DA25B7B92853B67600533DAD8F92B0ABFB1279
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......w....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........B...8...8.......^*oX........d...|...|...RSDS;.7..eI.N.VK>o.....api-ms-win-core-processthreads-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........oX............1...1...............+...X...................@...s...............#...Q...~...................Y...................)...[..............."...P...................C...............(...X...~...................3...P...q...........C...v..............."...

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-processthreads-l1-1-1.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E7E679DFD5704FB3BBAE35B1675F66D9
                                                                                                                                                                                                                                  SHA1:2C0CC9796DD06A69B6C0E0DC4A75A93AEB294B92
                                                                                                                                                                                                                                  SHA-256:057B0483FEE48563E78FF5A4CE27DB03B65189D8A9CB16B4E0D9CCDEAB769C81
                                                                                                                                                                                                                                  SHA-512:5393964B1DD842FE6BE7346A57ECEA8CD7460F5FA4596137B1A2B6DDF71DDCFF5E6584F3199D0AAD3B3C3C234D4CDB7A4C63A2E7954FD30B7B02F415EDD64855
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........B...8...8.......^*oX........d...|...|...RSDS`.8.R).A......V....api-ms-win-core-processthreads-l1-1-1.pdb...........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........oX........................@...x...........L...............7...k...................c...............0...q...........&...Q...................R...}...............................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstructionCache.kernel32.FlushInstru

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-profile-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3956225336012716E0E99541B5FF76F7
                                                                                                                                                                                                                                  SHA1:0127F03A4D71D74C9B3F1758CADCC620638B56EB
                                                                                                                                                                                                                                  SHA-256:BEF15C4F182503B9F9DC582552E47C01EFB2B6B6BF02B7EEECABFF49724F93B1
                                                                                                                                                                                                                                  SHA-512:CF9B7803F92EC345978B5E1EDAE05F0ABDE419D172A5246D77551CF8D546C22FD87D5A64E3F911EA877BE9190916264322CBD35EDDCE0D873AA53A3C4E6282AE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0...........@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........;...8...8.......^*oX........d...t...t...RSDSf@...^.E..L.=.......api-ms-win-core-profile-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX................................W.......?...x.......api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-rtlsupport-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5C5D8D4E26159DB2D0210E1B96B19387
                                                                                                                                                                                                                                  SHA1:C90060E6F97B25776D6501C33519D1DB414F3CD1
                                                                                                                                                                                                                                  SHA-256:77DCBC49D395DE32D0C7D5185D72E5EB80EAB63B3748F9E7232A6313DCA238F9
                                                                                                                                                                                                                                  SHA-512:91774F40708E110892AFF99EEC193E2450560323193E1ADE7DC12BC633939766C3FC76DBFC46C2FEF382B787C96590E998C4DE1E6318E865DE0AEE4C858E0534
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......AM....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........>...8...8.......^*oX........d...x...x...RSDS..V....C.;...#.\....api-ms-win-core-rtlsupport-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX....&....................... ...^...........L...v.............api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-string-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6BC77942A02C620F985F77338CF9FED2
                                                                                                                                                                                                                                  SHA1:9394DC62C5A6195BA3371B8A1FB9302B37D65E70
                                                                                                                                                                                                                                  SHA-256:9C74AB29CC474214B690BE7F35668EB31C9141CD98F43DF66EB1D960C47580D2
                                                                                                                                                                                                                                  SHA-512:1A3EFDE70E835F49A46D8E141AB5F9A4DF8C45FB7692A7ED5DCCDA0BA368F028ADAAE7B511D49B475E9A1890BD8C70B5A4DEC1869051196BD6FA3614EAEDBB28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......r.....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS.E(v..8E.....e.V....api-ms-win-core-string-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX....X...................(...H.................../...X...........z...................I...p.......................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.CompareStringOrdinal.CompareStringW.ker

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-synch-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A14512897863D230DA2147991A87EFD6
                                                                                                                                                                                                                                  SHA1:7F2001BCAEC0E1F592C584B8EA2B4141C5A191A5
                                                                                                                                                                                                                                  SHA-256:A63EC18946C80414C286DA083A8F8ED36C12B7B37B9B87C574E7AB85E76CAD53
                                                                                                                                                                                                                                  SHA-512:550E0F7ACE356535821D369833DF705D711FD26138952BABD180871EE588CCBF71FA680A3892948801226B1F151DEBD7D2CF051DD41F313B1E9B18ABE4DAC693
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0...... .....@.............................V............ ...................<..............8............................................................................text...6........................... ..`.rsrc........ ......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDS!}."..F......y.....api-ms-win-core-synch-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02..................oX............)...)...........P...........C...m...................&...M...r...............8...p...........;...k................... ...I...w...............1..._...................;...t......................./...`.......................>...e...............#...

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-synch-l1-2-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:154A0B0E4DF921852B403F9C3710EBE0
                                                                                                                                                                                                                                  SHA1:E6CB14F232A85609931704B006BD3950BAF0A874
                                                                                                                                                                                                                                  SHA-256:58C9475A169EECBEF8A404A73FDA8C4F57282E66E74BA19A1F5C081E9CEE7207
                                                                                                                                                                                                                                  SHA-512:A325BDB2AC6F854251AA742FCFA771769C3E8843BDD2BF8ACF6BE170C419F8A65473C2E3B9B149AA61F6452B39749E171FE5945B9D601C356C254CD18DEB4754
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......=.....@.............................v............ ...................<..............8............................................................................text...V........................... ..`.rsrc........ ......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDS...T.=hC....NNz.....api-ms-win-core-synch-l1-2-0.pdb............8....rdata..8........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................L...........2...o...............7...}...............B...s...............7...........W...................\...............(...e...............!.....................................api-ms-win-core-synch-l1-2-0.dll.DeleteSynchronization

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-sysinfo-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E857894AC70983971930040E7A49F150
                                                                                                                                                                                                                                  SHA1:856EB496C2430D13D37786B8C7A6E952EE3780C3
                                                                                                                                                                                                                                  SHA-256:41999A1A13DAD1469845960439F55810BD5DF2BAB70671D2EF0BCED0F76B19B5
                                                                                                                                                                                                                                  SHA-512:EB01DC1C853496480F7A4436FAEDD63261A03BF285D1D93E4B8FFB68B38B1BF03E215A6468645AE07E6BD6685568DFD0BBE38FF42ABCA2FA8BC162AD85D47726
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......5P....@.............................E............ ...................<..............8............................................................................text...%........................... ..`.rsrc........ ......................@..@....^*oX........;...8...8.......^*oX........d...t...t...RSDS.)h....D.)./.h[....api-ms-win-core-sysinfo-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................`...........I...r..............._...................S...................-...R...~...................6...e...............K...|...............8...w...................D...i...........................................................api-

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-timezone-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:17C1F6B7E224239A45DF2760AD534AA6
                                                                                                                                                                                                                                  SHA1:340D78BB270139EC7B771B8CEF0DA92639750CEA
                                                                                                                                                                                                                                  SHA-256:0B015BE1EFC6D20E6AD2A83704C2EFDAAF3738BBEB145BC663A098345F38C82C
                                                                                                                                                                                                                                  SHA-512:16AA3356C771593C314F922004B69386AFD207F5DE5466E5DC04FBDC8E10BEB28DF4B7421EE8ABD9024083B55ABBBFBA54BD4B60B07ABDE9F25E3332BDDC71C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........<...8...8.......^*oX........d...t...t...RSDS..z..F..../......api-ms-win-core-timezone-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX....b...................,...P...............S...............I...................5...z...........)...r.....................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZoneInformation.kernel32.GetDynam

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-core-util-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:11B9C82C32BC5C0EA66EEB491C246F90
                                                                                                                                                                                                                                  SHA1:117677B85D7B43F1640068A2E9A202E4887BA6F8
                                                                                                                                                                                                                                  SHA-256:17B0054B9B323C9E775B719F8938CA2BB98C329566B2DE1C763AAFEECB3BF316
                                                                                                                                                                                                                                  SHA-512:B3F4FD7631FABC01A3A7FEE9C47C7B1B02F5282AE283F003851E1DE3C6442989DE5A22E1E98CAE9E8C2EDFD6BCA5AB9BA27BE08D7DF3666F5072BB73AC936F24
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......u.....@.............................9............ ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDSn0?j.>.M.D$...W.....api-ms-win-core-util-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02......................oX....:.......................0..._...{...............Z...m.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel32.EncodePointer.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-conio-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EAD443B805F5DFDDF6B384B214B28DDB
                                                                                                                                                                                                                                  SHA1:8A82E3603936A6623514D0E707FCB48A5933C0CE
                                                                                                                                                                                                                                  SHA-256:2DA15EB964AB1E82D5ECA744AA1636EB667315F3EF84E365CE556AB8758C3550
                                                                                                                                                                                                                                  SHA-512:49FE8C2602C29D8652B85E46FD178C78615DCBA756A9A7B69EC9248716193DB747C60521B94DA1E50F009F7824C487E5FB1772B9D171F82C6F329E19C0821080
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......).....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDS.O..@..G..Pm.......api-ms-win-crt-conio-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX....4...........................l...............W...............7...P...j...........................,...L...l.......................,...M...o...........T...............>...y...........0...G...b...{...........................D...]...........................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-convert-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5760BEC3A8C82192D724254B80997B83
                                                                                                                                                                                                                                  SHA1:9638CBE7C220DD8ED432104C20FB9DBFFBF3E35C
                                                                                                                                                                                                                                  SHA-256:BA51A438D47331DEEF6178345B235E768A4E648D43FD44E28B95E7292CD4F04C
                                                                                                                                                                                                                                  SHA-512:56892E8B9D1E34210821B41DEFAA60E9D1D0014CF827A0AB358BFDEA29E95DD5D82565ECD8D81AAEF2B93F2B30AEF7B1898691ADC0660278E5C9047DA33FF070
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!.........................0...............................@......*.....@..........................................0...................<..............8............................................................................text............................... ..`.rsrc........0......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS*.....A..>....R....api-ms-win-crt-convert-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02..................oX............z...z...........................I...b...}...........................;...S...j...............................0...I...`...w..........................."...?...^...........................>...^...........................*...C...\...x...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-environment-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A8B527FA19DA868DDE67C429398ADDC0
                                                                                                                                                                                                                                  SHA1:7CA13408565890F1F96CE838C818F2FE4B8B5A7C
                                                                                                                                                                                                                                  SHA-256:1F62695F9FB0FC6FECA4283BB4BE26EEEA1C5F10368AD51C8A5D910D3E105188
                                                                                                                                                                                                                                  SHA-512:18C9A578BAA8CAC20F0610C0939FE69638B00DE09E9CEBA72DA4801277C64EAB1C7AE12DA63E087BFE2361B4454229A7C68983D0D30F82FC4E82AA2BF23E33F2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!......................... ...............................0.......9....@............................."............ ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@.....0oX........>...8...8........0oX........d...x...x...RSDS......H..Z..(O.....api-ms-win-crt-environment-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02..............oX........................P...............4...O...j...........................<...Y...v...........................*...G...`...}.......................1...P...k.......................................................api-ms-win-crt-environment-l1-1-0.dll.__p__e

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-filesystem-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2AB82A2368023085FFB3E2C4DF1483D3
                                                                                                                                                                                                                                  SHA1:5C7204631683653644771354B4282C63C994DAD8
                                                                                                                                                                                                                                  SHA-256:9480BB7257C40483E6CB6433CDD90871D55912BDBCFB87F33C11D7401F50F94A
                                                                                                                                                                                                                                  SHA-512:96F1AE8252D353297517B9459A359FC617D1065AAFEFA1532DF44CB7781A2C16D5E1429FAD3330EFDDD874A0B00592146B2582CD9D9D918BBEDF97823D4825A2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......G....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........=...8...8.......^*oX........d...x...x...RSDS.......C..9........api-ms-win-crt-filesystem-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX............A...A...............................&...A...b.......................A...e...........................?...]...|.......................(...F...b...~.......................%...B...^...w...................5...[.......................)...C...^...x...

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-heap-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4BCE918C3F34C152EA99591B7501C932
                                                                                                                                                                                                                                  SHA1:B83E00BDBC78AF04146E267A98BCCB1597902203
                                                                                                                                                                                                                                  SHA-256:ED8B2DEF856E4EFFCE4856EFCC7F3C35FB7E3428287BA8851CDE2DA8DF1D1C58
                                                                                                                                                                                                                                  SHA-512:463D73D57CA18C91E401B0293F78286D1D3221775F4A2EA3EE3E59137697BEDE9327F32B0335E4275626F1B31030543E6ABD48988A1F976EC1DD3CBC1B680A9C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......B>....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........7...8...8.......^*oX........d...p...p...RSDS>3..IE.I.'..h.......api-ms-win-crt-heap-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX........................t.......C...j...............3...f.......................6...Y...t.......................C...d.......................5...Z...................U.......................%...P...k.......................5...Z...w...........................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-locale-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:53D8E61BA651A14E136C3AC3D30DFB35
                                                                                                                                                                                                                                  SHA1:A470DBD794D0A3A23D01F13D146E8CEF8DEC6886
                                                                                                                                                                                                                                  SHA-256:37489D3F078513ECCCB7BFB9F18EC1338D011B91AD091085AD1DB02F633A23BF
                                                                                                                                                                                                                                  SHA-512:2BE10659F627BF456D0E75BFE58F2306141841E6EE2D38A742C2E9F4282122075DE42A882639643FDA9957026EFCB0E6DFC00995C911515FAE94690923A9BFC8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......n.....@.............................e............ ...................<..............8............................................................................text...E........................... ..`.rsrc........ ......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDS.Gt.^..E......."....api-ms-win-crt-locale-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................X...........8...n...............Q...w...................D...d.......................2......."...W...............C...h...................;...V...{...................(...........................................api-ms-win-crt-locale-l1

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-math-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6DB484B0D207FD72B5DB5CA490BD4CA5
                                                                                                                                                                                                                                  SHA1:8B7A5BB7CE4007B26545FD22902048E05A646446
                                                                                                                                                                                                                                  SHA-256:1D8E2B59452B927CC3E0F75B2D5277B667A503C53507FDAC11D3D8B44986080D
                                                                                                                                                                                                                                  SHA-512:9419CE9148F7C6A473412036BCBCA9672F47390295E8A84858F50556C22B66A7385BCEE089715ECD7FF1CF5C59257717A75444BEE1A4D3E4332326BBC407E0FA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!.........................@...............................P......./....@..............................+...........@...............4...<..............8............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@....^*oX........7...8...8.......^*oX........d...p...p...RSDSy..H...N.`N..%.U....api-ms-win-crt-math-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02......................oX....L.......:...:...............s........................... ...8...Q...j...............................-...G...b...}.................... ..I ..u ... ... ... ..%!..O!..y!...!...!...!..&"..S"..}"..."..."..."..%#..O#..z#...#...#...#...#...$..$$..<$..S$..h$..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-multibyte-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:55CE323CCBC72920750D305C0B2A09C4
                                                                                                                                                                                                                                  SHA1:8C51F65875CCE5C049078FE0209A9A9D1CB98031
                                                                                                                                                                                                                                  SHA-256:86CC087D197B1243413C0963B6F132648489FE26A4A11A7A77163744810E9165
                                                                                                                                                                                                                                  SHA-512:B760A985F6FC895CCB0D9E0D99D4215CBC90F5D85DFCF46D96DC727C3E5CCEA424D8B04C21FAE8E2F32127BB6B4E1D63B3AC43BD21B22859D3C6941C8052AFA9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!....."...................@...............................P............@.............................. ...........@...............(...<..............8............................................................................text....!.......".................. ..`.rsrc........@.......$..............@..@.....0oX........<...8...8........0oX........d...t...t...RSDSZB ...7D..... ....api-ms-win-crt-multibyte-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02..................oX........................(...H.......0...R...u...................$...G...k.......................A...f.......................5...X...{...................*...M...p.......................=...^...}...........................Q...t................ ..# ..F ..i ..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-private-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2FC37A3FF68CFD063E5DD7CBA78AB662
                                                                                                                                                                                                                                  SHA1:BA1DE389B957BF0B0327D4579F089FD0AE7C1185
                                                                                                                                                                                                                                  SHA-256:2E923D6A71496460C68AF6D771BA139098918F5E2C7BDB284251DD18D0A81335
                                                                                                                                                                                                                                  SHA-512:ED45504B82BFA3331E63F662C474D61E3F041611F1594507734ACFDDCDE7C9530BA5FF7011BEAB19D70E4F3A804F98408CA0F6FD2FB7FE142C979E74CB941754
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................................................................@..............................................................<..............8............................................................................text............................... ..`.rsrc...............................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS+.t.!i.K....!,......api-ms-win-crt-private-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02..................oX.....>..................8#..h5...>...>...?../?..l?...?...?...?..&@..e@...@...@...@..,A..\A...A...A...A...B..ZB...B...B...C..PC...C...C...C...C...D..QD...D...D..5E..rE...E...E...F..7F..hF...F...F...G..EG..mG...G...G...G...H..3H..^H...H...H...H...I..MI..zI..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-process-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:539EDF31A28B27491FB6422F9BA24748
                                                                                                                                                                                                                                  SHA1:BBB0F9B93BFAC0C5CEA62F338D9F238A630EC1E4
                                                                                                                                                                                                                                  SHA-256:3103333EB85CAB4F9473D576680EB2AB2E60F6130EBCB7371BB308179C23DDB7
                                                                                                                                                                                                                                  SHA-512:0363FC4FB8CA1DD768E8412415B6A473BFBF9B61673EFDD5C92C349DDBEDF68B60A44D6E83A10ED8F7485E2DB6B36B9EE76DE6D18E06442BF78E9C5EE4E02329
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......O+....@.............................x............ ...................<..............8............................................................................text...X........................... ..`.rsrc........ ......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS..p...DO..D.F.......api-ms-win-crt-process-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02..................oX....p.......$...$...........(...........................)...A...Z...t.........................../...J...f...........................&...A...]...y.......................&...D..........................."...9...R...k...........................&...A...\...y...

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-runtime-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8C137389AFCCACCCBE5864FBA3464F48
                                                                                                                                                                                                                                  SHA1:FB99931A34143B93E5E7A72166AF830BBB389157
                                                                                                                                                                                                                                  SHA-256:8AFDAF1C630AECB97AB5625AC8483664643C526BD705DECFAE0DAAF2481F0A81
                                                                                                                                                                                                                                  SHA-512:4723F709483BC62B4200A5E5CC48C8AF77994B0D06D0DFA3737AD40CB20099DB4BCDF69EDFAAB7F315E1CDF47866FEB473BB4F1D26B25F5823F1A2EA2E1A04CD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!.........................0...............................@............@..........................................0...................<..............8............................................................................text............................... ..`.rsrc........0......................@..@.....0oX........:...8...8........0oX........d...t...t...RSDSx..&...M..[.........api-ms-win-crt-runtime-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02..................oX....6.......k...k...........`...^...{...................#...C...d.......................7...Z...}.......................>...V...o...................6..._.......................:..._...z...................U...............>...............1...R...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-stdio-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:549F6735F986E1DDC0C85A3502052FEC
                                                                                                                                                                                                                                  SHA1:4CF90329F18993C0982CACC1D718E0308176971B
                                                                                                                                                                                                                                  SHA-256:8824840D84F561D2B46D13F30484683C36328850A596F1E2EE48BCA2E7DE2D30
                                                                                                                                                                                                                                  SHA-512:51FF305D59E2D1A365095406E9F56B28E57CD95AC36955D93A8F2D6B3DD3D474B30643CF527A67760C540E83517AEE2F743214C931CF5E58BC79AE016A47B64F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...u0oX...........!.........................0...............................@...........@.............................a............0..............."...<..............8............................................................................text...A........................... ..`.rsrc........0......................@..@....u0oX........8...8...8.......u0oX........d...p...p...RSDS].[=.0B....w.....api-ms-win-crt-stdio-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02......................oX....>...........................n...................Y...............H...............=...x...........(...e...............$...>...V...n...........................4...U...w.......................:...[...}...................1...U...w................ ..' ..J ..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-string-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8F0CB5CA0C982EFCEC40241F81F9CC11
                                                                                                                                                                                                                                  SHA1:3AF0FC542FE2D63EA5ACD117E91DE134FED3B5EF
                                                                                                                                                                                                                                  SHA-256:6147EB7E5BD6AC004301350EF4B168E552B82E301E14DCF3B10DF88D833DC1BE
                                                                                                                                                                                                                                  SHA-512:E6C9EF79F472BD2AE555A9EFB606176674D22FB7BB359F268BC0B572382AF0336694171A3EC4F5CC986F2EEAE63BC0804198715D0494A6C7D58C4160E6E9B966
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!.........................0...............................@......8E....@..........................................0..............."...<..............8............................................................................text............................... ..`.rsrc........0......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDS...1...I.;..........api-ms-win-crt-string-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02..................oX................................'...C..._...|.......................1...P...m.......................+...J...i.......................+...K...l.......................2...S...u.......................(...B..._...}......................./...N...m...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-time-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B3F20781C32907A02B16C8E8E2A32E74
                                                                                                                                                                                                                                  SHA1:615E9A72372C69583D0C53E461554EAE1368D34A
                                                                                                                                                                                                                                  SHA-256:DC7F41906EDF362829B5E9157BA0C1DA73CE32F95B4CB468CCE96521C4C4AC8C
                                                                                                                                                                                                                                  SHA-512:F928A79699AF5B89D674DAF8915C7321FEEBDD0BA30F611228A88C9781CE2DA3C99A724CC8385FE721556126871522B53D149118F747749E665A0754FBDFE15E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!......................... ...............................0.......G....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@.....0oX........7...8...8........0oX........d...p...p...RSDS...['.H.D.w.......api-ms-win-crt-time-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX............H...H.......(...H...........<...Z...x.......................6...S...n.......................$...A...^...{.......................B...c.......................&...K...p...........................K...k.......................%...E...^...y...........

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\api-ms-win-crt-utility-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EAD03B9A61A23FF6275CA364A1C6536F
                                                                                                                                                                                                                                  SHA1:4221BE864A141079699E80B6B121BEB08D20C3C0
                                                                                                                                                                                                                                  SHA-256:DD0D05FEADF990EAA82D691BE1990A2BD2EBE7F9874880D1871760DC15D9B3C1
                                                                                                                                                                                                                                  SHA-512:E8B238BFF471D06439E170E90AF93251818F434CA56491494EE2D9684A1837825F2B169F9DC73201C5563DC7500C2438A6081DE56DD1A0B0CAB25C9382D6BFC5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!......................... ...............................0............@.............................^............ ...................<..............8............................................................................text...>........................... ..`.rsrc........ ......................@..@.....0oX........:...8...8........0oX........d...t...t...RSDSI.R...O..T..f.V....api-ms-win-crt-utility-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02..................oX....4...........................]...~...................%...<...U...r...............................+...B...W...p.................................../...V...m.......................5...L...g...............................!...>...O...h.......................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\atl90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:64ECA1F64E4A988A6C5C93F3E5D66236
                                                                                                                                                                                                                                  SHA1:06FD9138C430E7F2D390B9A58EDF5D949F57057F
                                                                                                                                                                                                                                  SHA-256:AB93DF816C284AC247B9087663BC449BEB26E6F64D9F8A6BE2EFECAFA7A9CEDC
                                                                                                                                                                                                                                  SHA-512:9646AF577AA1390747CC58806D5BBA167F21D4E6A05A87DDF200F3E0D64CCC05F2C0155E4DA4EF89B17EEA5FAC748BE9E4D6D074945D0BD07AB2D19E0D5FF3E2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v.92..j2..j2..j.j.j0..j,.gj"..j,.qjG..j.j.j1..j2..j..j,.vj...j,.`j3..j,.fj3..j,.cj3..jRich2..j........PE..L....=1G...........!.........~.......2.............x.....................................@.....................................(....@..."...........T...#...p.......................................[..@...................d........................text............................... ..`.data....0..........................@....rsrc...."...@...$..................@..@.reloc...'...p...(...,..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\aws-c-common.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:299692A9E5ABD161B2BC22BCBF352CF0
                                                                                                                                                                                                                                  SHA1:731C2052E69CCEDD727655E8AE46D30BAE5162D3
                                                                                                                                                                                                                                  SHA-256:E781227A9281F05CE385545ED7B3FA99798D46D394966DEAB881A2E361E596FA
                                                                                                                                                                                                                                  SHA-512:2EFD124778351B4263F14E4F6BB45BA693CA9B9711E6F09F152C2F811C9AE07CF6BC54176984F679FCDBD7807E9702362F82B11BE58333D2669FAFD3438286F8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........eO.j...j...j.......j.......j.......j.......j.......j.......j...j...j.......j.......j.......j.......j..Rich.j..........PE..L...T.<`...........!.........................0............................................@..........................u...C...........................................q......................`r.......q..@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\aws-c-event-stream.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EA7CB849B4BCA695D0A9FB9E65909809
                                                                                                                                                                                                                                  SHA1:00D354CB92CC00A75A40FC8E670301143E292249
                                                                                                                                                                                                                                  SHA-256:706D9E6EE98C0D06EFA87C698F75CEFC81F78CFC875965E9ED738990E426B78B
                                                                                                                                                                                                                                  SHA-512:95ACF9195633275495771D7EAD1359C5A2E6E123F49EDF6E5E7823D918A0BB750FCEED4704DF6074B9DEED5751256B375437AAABF3DAED5E11A81E009C16F79D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.{.....................P.......P.......P.......P.......g.................2...........................Rich............................PE..L...|.<`...........!.........(.......2.......@............................................@.........................@M.......T.......p...............................I...............................I..@............@...............................text....,.......................... ..`.rdata..`....@.......2..............@..@.data...L....`.......N..............@....rsrc........p.......P..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\aws-checksums.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A136C0471245853913CD78B081B379BD
                                                                                                                                                                                                                                  SHA1:7FDF71D167E3B3FAC32955671B6DDFAD214320B8
                                                                                                                                                                                                                                  SHA-256:5C073359C8C0E5B4BE7818F53D3E6157AA1B60C2EF08034558B1775F950CE695
                                                                                                                                                                                                                                  SHA-512:79577013313E2C099753DD8831A8073CEBBC4E2638130AB50BBA9C6D460025B2FB3C08A16A648BD2B21AEC019E0339CCAE558DEB366504639C82D96DF6FBDCDE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........~...~...~....1..~......~......~......~......~......~...~...~..R....~..R....~..R.]..~..R....~..Rich.~..........................PE..L...i.<`...........!.........................0............................................@.........................0...........P...............................t......................................@............0..h............................text...V........................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\aws-cpp-sdk-core.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:69C397CF479ABE6230E237C7B3038D27
                                                                                                                                                                                                                                  SHA1:7F0A90EFE55D6561342A784CBBB706829F2F3B39
                                                                                                                                                                                                                                  SHA-256:8F48BCE06E8F23DF42120E3FE000F9CAB3B3DDD89C492ACA4D01AEDEE5BC64AA
                                                                                                                                                                                                                                  SHA-512:C3532E99E2EE087812F973B4063575B5AD48AE30FFCEA5BF662DFA7FEE1708FD778FCD169BE2757B330FE8357D378CB54A869C8A4C99B53A43B57DB67E34431E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...h.}.h.}.h.}.a...|.}.:.|.l.}.:.x...}.:.y.b.}.:.~.o.}..|.l.}...|.y.}.h.|.R.}..x.C.}..}.i.}....i.}....i.}.Richh.}.........PE..L..."~@`...........!.....l...v......&........................................ ............@......................... ...T...t........`.......................p......@...T...................8...........@...............$............................text....j.......l.................. ..`.rdata..............p..............@..@.data....J.......F..................@....rsrc........`.......<..............@..@.reloc.......p.......>..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\aws-cpp-sdk-s3.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0FF97286890816FE8551356BD08786F1
                                                                                                                                                                                                                                  SHA1:D38A6E7AB634892A4B6CA86DE2A3A31368AB35CB
                                                                                                                                                                                                                                  SHA-256:3FDEB94E5D3DE9A88DF75121E0B8DDC1E6969F609FACCF8DA024C267D00ECC5C
                                                                                                                                                                                                                                  SHA-512:376EDE4A02A11DBC0C1E12B199E0477A028F14640DF086D12949E66850D1032A788F25FFD38626C444DFF98C07EE1DBB86233C0C9143F61B47E6ED764B4C511F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..9r..jr..jr..j{..jv..j .k`..j .kx..j .ks..j .kv..j..kp..j..kq..jr..jV..j..ks..j..ks..j..Bjs..j..ks..jRichr..j........................PE..L...o~@`...........!.....^..................p................................4...........@.............................0...@.0.......3.......................3.Lw......T...............................@............p...............................text...u\.......^.................. ..`.rdata..~....p.......b..............@..@.data........P1......:1.............@....rsrc.........3.......2.............@..@.reloc..Lw....3..x....2.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\aws-cpp-sdk-transfer.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C0BC9B2E0629154B5B66BAC7A5F7C6C6
                                                                                                                                                                                                                                  SHA1:C7E1DC50018D9FEE541F16642361F0CADBC85EC5
                                                                                                                                                                                                                                  SHA-256:93115889C0FB5BEEA1A1EE29A64189C84AD3BB5B5BCC51F401888468C55F3150
                                                                                                                                                                                                                                  SHA-512:E00692DC2CE3665D00D5078C92B7FEA65999120649F3D6830296DA114D3F316C451B91A929DE95963DD550A50DDDB80A67876B200FEEC5D25DE9C63FE35758C8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................\..................................(........@..(.....(.....(.0....(.....Rich...........................PE..L...-.@`...........!.........&.......w....................................................@..............................=..LG......................................P...T...............................@...............<............................text............................... ..`.rdata..v...........................@..@.data...D*.......(...x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\bcdedit.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3C2A9F3195CDDD8943971DC8A677EF25
                                                                                                                                                                                                                                  SHA1:FE65E384BEF1A26E2968427C02D246FA87FF2B75
                                                                                                                                                                                                                                  SHA-256:28C47B5017260EC82AE70456455953F6DEAC2D6B6590CEC206F9AB8C5D3FDE50
                                                                                                                                                                                                                                  SHA-512:0A5049B3FF5EFA18E4EAB9BD30537C531999AEF7CE1B6A4967CD43D0124D781D2DD665F42FCCE6ECAD22F131571126BFCA74BD0D55F8489EA043F01920AFB879
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r&..6G..6G..6G..??@.?G..??Q.$G..??F.?G..6G...G..??V.RG......7G..??A.7G..??D.7G..Rich6G..........PE..L.....[J.................>...B.......$.......P.......................................]....@...... ...........................?..d....`..........................@.......................................@...x...X....................................text...|<.......>.................. ..`.data...4....P.......B..............@....rsrc........`.......F..............@..@.reloc...............b..............@..B..[J(...o.[J5.....[J@...~.[JJ...........KERNEL32.dll.msvcrt.dll.ntdll.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\bootsect.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9594BC046765DF20F4AC8DED4D1DD5D8
                                                                                                                                                                                                                                  SHA1:95DE0064B529D0EE2A0BC786D3511A9376352847
                                                                                                                                                                                                                                  SHA-256:4C457232DD4B8E3589F2F38F705089BAF568B1E9EC1554A0A3022B39F4286E76
                                                                                                                                                                                                                                  SHA-512:5C1110603239D314AD8216E3503ECB78F40D2C286810E4AF7944AB4FDB0591E96A64268D545CD950696651E2A4E85529F1220A188CF7013DB827D8FA23A5A6B1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[..5...5...5.......5.......5.......5...4...5.......5...K...5.......5.......5.Rich..5.........PE..L.....[J.............................h..............................................vi....@...... ..........................D...d....`...:...........................................................E..@...x...X....................................text............................... ..`.data....k.......X..................@....rsrc....:...`...<...0..............@..@.reloc.."............l..............@..B..[J(...o.[J5.....[J@...~.[JJ...........KERNEL32.dll.msvcrt.dll.ntdll.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\dlconfig.xml (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with very long lines (356), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:64FA6A2B969428202B88FE8F68AED572
                                                                                                                                                                                                                                  SHA1:4F62FC2661A68654F960FDF6F1B7E000E720B9CE
                                                                                                                                                                                                                                  SHA-256:932F206929E5F763A35F825326E22569CCDD7D306A729435395D947C9A9E8EC0
                                                                                                                                                                                                                                  SHA-512:C3BEB6A297F4EFFA389EDB8DB0A25A25DD66395D0EC00C589D682BB99EEEA4F8FBE3615BAC63D356099E940B34F3FB72E668D0F30643CCB0382C87746DCF6333
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0"?>.. Encode = ANSI -->..<DOWNLOADER>...<SETTINGS>....<TRY times="3"/>.... winpe3 x86 1,101 winpe3 amd64 2,101 winpe4 x86 3,101,401,10, winpe4 amd64 4,101,401,20, winpe5 amd64 4,101,401,21, winpe x86 3,101,402,11, winpe amd64 4,101,402,22 -->....<VALID id=""/>....<GRAPHICS ui="1"/>....<PROGRESS is_one="1"/>...</SETTINGS>...<OBJECTS>.... x86 -->....<OBJECT id="1" name="BCD" path="Windows AIK\Tools\PETools\X86\EFI\MICROSOFT\BOOT" range="1352972288-1353234431" md5="1fe7f25994f3eddbfa8aaa9d8c56d667" url="download.microsoft.com/download/0/4/C/04C805CC-4C04-4D76-BE80-7D67B951CF73/waik_supplement_en-us.iso"/>....<OBJECT id="1" name="WINPE.WIM" path="Windows AIK\Tools\PETools\X86" range="336336896-450673718" md5="32b2288d84959c879a5aa6af1caa9263" url="download.microsoft.com/download/0/4/C/04C805CC-4C04-4D76-BE80-7D67B951CF73/waik_supplement_en-us.iso"/>....<OBJECT id="1" name="BCD" path="Windows AIK\Tools\PETools\X86\BOOT" range="450674688-450936831" md5="603c40

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\easepxe.ini (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Generic INItialization configuration [DHCP]
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0633946446DE67F3C969E7CBE3ACD57B
                                                                                                                                                                                                                                  SHA1:70D6CD9DA51C68BB9EF0CF5D4A85A267CB9418F8
                                                                                                                                                                                                                                  SHA-256:97E06B24456A0FA2DA3CCECC959D0AB72F9524FB22A2EADCBB70A867883459B1
                                                                                                                                                                                                                                  SHA-512:8B16CCD2384A48F1DBA8B140FF3FB68B8817168DF4A3E20B27A85F9CA1DDADC7215C99C601C0DA2B38C802F2AEF5B6BE2F8BAB469CC7A5CE2DD6607C68CF4D38
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:[easepxe]..BaseDirectory=C:\Program Files\EaseUS\Todo Backup\bin\..TftpPort=69..Hide=0..WinSize=0..Negociate=1..PXECompatibility=0..DirText=0..ShowProgressBar=1..Timeout=1..MaxRetransmit=6..SecurityLevel=1..UnixStrings=1..Beep=0..VirtualRoot=0..MD5=0..LouserP=..Services=111..TftpLogFile=..SaveSyslogFile=..PipeSyslogMsg=0..LowestUDPPort=0..HighestUDPPort=0..MulticastPort=0..MulticastAddress=..PersistantLeases=1..DHCP Ping=0..DHCP LouserP=..Max Simultaneous Transfers=100..UseEventLog=0..Console Password=tftpd32..Support for port Option=0..Ignore ack for last TFTP packet=0..Is Proxy Dhcp=1..[DHCP]..IP_Pool=824207444..PoolSize=0..BootFile=easeus.bin..DNS=1953719669..Mask=1902465594..Gateway=543649385..DomainName=..Lease (minutes)=0..AddOptionNumber1=9959792..AddOptionValue1=<..|A..|4..AddOptionNumber2=2090138457..AddOptionValue2=\..|......AddOptionNumber3=0..AddOptionValue3=h....AddOptionNumber4=9960128..AddOptionValue4=.p..............AddOptionNumber5=4..AddOptionValue5=H.................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\easeus.bin (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS executable (COM)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AD0F6F809EE71B7AE9EDDE6FF7A3DD34
                                                                                                                                                                                                                                  SHA1:FF0980DC0792819E3E42FDCE7E6E58E98A57569B
                                                                                                                                                                                                                                  SHA-256:DD3E8E8FABBDBBCCBE33FCB89AA319399B77F86844513DE3BC025B570455A871
                                                                                                                                                                                                                                  SHA-512:87364AE2A8A1845730DFF8F942C9990AA329D3EF58BC906189C9311FCD6EB461125AF477F817055732B2E41AA7BCEF2898F6BF223645920CCB92C3EF91938484
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.>.. 9.............................................................[..C........SjS...4..f.>.................t..L.h. ....1..........1.A..r......1.1........f.GRU.f9.u...... ..f9.uJ.r;......$?t........h...1.`.2.as.`1..).aOu....w/.......r.w...1.....1............RVWU...]_^Z.....f`......`.. ...."......f1.f1.f..$...f.....$..".....1.V..|W..V.............f........ ....fa...h.......<.u....Missing helper...............................X....P....r0.>..U.u(.....Kj@.......'.f1.1..D..u.8T.u.f.D.E.t....................................................................................................................[......"....1.1...f.t<..t.1.f1.f@u......U....f.......D....\.f.D.f.D.....f`.B.J.fa.fP.[.l.f@.............fXf.>......u..1..........[...........S.......Q............u.9.t.... ... .r;.....1.1.......h=..... ...1.1....................Ku..+....p.. x..............-.....-....Ku..1.....f1.6..f...............N...................../menu.lst..........................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\euLog.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1F949D8AA38D85C4968DCA9A75DC147F
                                                                                                                                                                                                                                  SHA1:6D3843336EC92409734AABD0012ABDCA907C9A21
                                                                                                                                                                                                                                  SHA-256:7348EBCF8B44EC5653D9608F793E30D40474BD88AB447A12570B7ABAF9377731
                                                                                                                                                                                                                                  SHA-512:41738AAC68852BB46CDF02C34AC2C8BB0CA1D50F4C4869A31C3612E1180B655AC753BDAF9939BF9AEDB8B4C612DB9AA4C8BC0B580061FE546EE9FAED5585CA60
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............`..`..`......`.....`.....`.....`.....`..a...`.....`.....`.....`.....`.Rich..`.........PE..L......e...........!....."...*.......'.......@............................................@..........................V..U....O..P....p..t............P...*...........B...............................I..@............@..X............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......>..............@....rsrc...t....p.......@..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\euimgprt.inf (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Windows setup INFormation
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D479620907D07C0051906C48ABC88F37
                                                                                                                                                                                                                                  SHA1:4D03604958DDA1AC63BE65239E71ECEE384F1870
                                                                                                                                                                                                                                  SHA-256:3667132E03E0172FFF75D6DE245CC04D35B56D0ECD81B6BCFA9E8B225B75F230
                                                                                                                                                                                                                                  SHA-512:DB8618D674E7C15CF46C0F10F7FA2B3A0C7F1EF53D53DDFC2184FEADD27C0C351F5728BBA7693DFB0B2FD14C2CF5FC575A67FAC684B8B4AB41825781A3ECECB2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:;;;..;;; euimgprt..;;;..;;;..;;; Copyright (c) 2001, Microsoft Corporation..;;;....[Version]..Signature = "$Windows NT$"..Class = "ActivityMonitor" ;This is determined by the work this filter driver does..ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2} ;This value is determined by the Class..Provider = %Msft%..DriverVer = 06/16/2007,1.0.0.0..CatalogFile = euimgprt.cat......[DestinationDirs]..DefaultDestDir = 12..euimgprt.DriverFiles = 12 ;%windir%\system32\drivers..euimgprt.UserFiles = 10,FltMgr ;%windir%\FltMgr....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..CopyFiles = euimgprt.DriverFiles, euimgprt.UserFiles..DelReg = euimgprt.DelRegistry....[DefaultInstall.Services]..AddService = %ServiceName%,,euimgprt.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..DelFiles = euimgprt.DriverFiles, euimgprt.Use

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\eunet.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1D23371D952DABF52B5694FA870DEA81
                                                                                                                                                                                                                                  SHA1:DDB26CAF5A44B834E6FD8B08B60DCDB5718CFA46
                                                                                                                                                                                                                                  SHA-256:68C971EA2D3AEB8F2FEBA9CCEFD8D5F91946CDBA7B8A9575E459A9431A0923AB
                                                                                                                                                                                                                                  SHA-512:5CEF9BE7FF91211BB601F9A4AFC50B2D232DC8741306103B56802A998EE44D28E4767298BEC29B7659EE7FB9D1CEB32C4144DADFF444EE2F1964E43CFAF437F5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................................5...........................................Rich............................PE..L...x..e...........!.........b......F...............................................L.....@..........................F..w...4<.......`...............^...*...p...... ...............................8 ..@............................................text............................... ..`.rdata..W7.......8..................@..@.data........P.......4..............@....rsrc........`.......:..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\eut.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:53A82E80B8AB0B1936D1049AA8CFD4ED
                                                                                                                                                                                                                                  SHA1:A577DBC08822FF6DCDA187A7C3CC2A5DC9A60212
                                                                                                                                                                                                                                  SHA-256:C1372C8B1B6EDDD8C3E7FABBDB1669F6C7B498C2DA00FB0FE53832509F3DC2C8
                                                                                                                                                                                                                                  SHA-512:55AA88ED9D7C0B03BB0A6CBDCCF12ED2647C690CED9E776B6B882D36FEFCD5FC48705A31AEEC256C4BB5C6EE56DD772E6F8E73F2037177A2B3D633145130FAD6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.e3a..`a..`a..`..`c..`h..`p..`h..`...`h..`Q..`F"f`b..`F"p`h..`a..`...`h..`c..`h..``..`Richa..`................PE..L....~T.....................j.......o....... ....@.......................................@..................................S..d....................~...............!...............................E..@............ ...............................text...4........................... ..`.rdata..J=... ...>..................@..@.data....-...`.......R..............@....rsrc................b..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\fileicon.txt (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BFE418E75E45407A8AF01537837BBE16
                                                                                                                                                                                                                                  SHA1:317F92E50D8B31A88B6873F9D6806515122F88E6
                                                                                                                                                                                                                                  SHA-256:3A0D27BDC01A92D6A9D5B2F14A160A614748ABE8CDB0AD6823F47EE388E6F37C
                                                                                                                                                                                                                                  SHA-512:CA0FDB9112F66D2B7DC91F953A50860DB2F23B6BFE67A212336D39D168EA8866CC655702BA54108BE0386F0C4DC739F8BD4B997BDE0D4EA15451C0B6B48B61AA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:386..386.png..3ds..3ds.png..3g2..sp.png..3gp..sp.png..3gp2..sp.png..3gpp..sp.png..7z..ys.png..8ba..333.png..8bc..333.png..8be..333.png..8bf..222.png..8bi..222.png..8bp..44.png..8bs..44.png..8bx..44.png..8by..44.png..8bl..44.png..aa..aa.png..abr..ones.exe.png..ac3..sp.png..acb..222.png..acbl..222.png..acc..sp.png..ace..ys.png..acf..acf.png..acl..acl.png..aco..aco.png..pdf..pdf.png..act..sp.png..acv..ahu.png..acw..acw.png..adcp..adcp.png..ado..ado.png..adpp..adpp.png..advs..advs.png..ahs..ahs.png..ahu..ahu.png..ai..ai.png..aia..aia.png..aif..sp.png..aifc..sp.png..aiff..sp.png..aip..aip.png..air..air.png..ait..ait.png..ameproj..ameproj.png..amp..5.png..amr..sp.png..ams..5.png..ant..ant.png..ape..4.png..api..api.png..apl..apl.png..apln..apln..application..application.png..appref-ms..appref-ms.png..arx..arx.png..arj..ys.png..as..as.png..asa..jsp.png..asax..wtx.png..asc..as.png..ascx..wtx.png..asf..sp.png..ashx..wtx.png..asl..asl.png..asmx..wtx.png..asnd..Adobe Soundbooth-6.png..asp..asp.png

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\fscLog.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7A65A83BEFA4F6FF5D1C7237E7C240CB
                                                                                                                                                                                                                                  SHA1:8431D8631A4509D80589B3E7279B9E612D07FE36
                                                                                                                                                                                                                                  SHA-256:154DF8AE37D09DBECEA9A82DC145A85DD631AF9B4D6C87E4362D57719C5CDBED
                                                                                                                                                                                                                                  SHA-512:CB9A50465E59E0A9A6275F3148D790637447DB2E8E8994503FBA51200A2CD3D60B14E8276061C94BD08B0C540EB043D4C69D1D57F14993535A31ACBEEC2C6B75
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b....V...V...V?..V...V...V...V...V...V...V...V...V...V...V...V...V...V...V...V...V...VRich...V................PE..L..."..e...........!.........................0.......................................:....@..........................B..X....;..P....`...............8...*...p..P... 1...............................9..@............0...............................text...o........................... ..`.rdata.......0......................@..@.data........P......................@....rsrc........`.......0..............@..@.reloc.......p.......4..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\gdiplus.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D0AAAE16BA162DD89D646887F1539855
                                                                                                                                                                                                                                  SHA1:0A222F319B7712B861EF6ADF0C38CC2C5A2790FA
                                                                                                                                                                                                                                  SHA-256:D84E7EB505ADEE8EA660F48C89705977F5EB33B7299D0BD981624E3ECE320223
                                                                                                                                                                                                                                  SHA-512:6D7CF7B3A1DC0560791BC3DB4FC836AD0F58B8B531C593D96A37BB77AFA3AB7DD6BD4D66A97E37CDE3443078EB189609D8D36119198C60CE6B74C1A093000769
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9=.XS..XS..XS.r{J..XS..XR..YS.r{...XS.R{O.GXS.r{l..XS..{...XS.R{N..YS.r{n..XS.Rich.XS.........PE..L......;...........!.........`.......r.............z................................7...............................@j..CN...w..x....`..........................hs..h...8.......................................|.......,............................text............................... ..`.data...L...........................@...Shared.......P.......@..............@....rsrc........`... ...P..............@..@.reloc..hs...........p..............@..B..w;8...b.v;E.....w;O.....w;Z.....w;d.....w;n...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ole32.dll.ADVAPI32.dll..............................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\goserver.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:863D8AA78CF008801B9ACFA66121E5DA
                                                                                                                                                                                                                                  SHA1:59429362D2EC4220D654785213618C78154A7387
                                                                                                                                                                                                                                  SHA-256:4DB4BAE7443EC161A36950C91EDF080BB19E2A78FA25B6CB0215BDDA60D4BF38
                                                                                                                                                                                                                                  SHA-512:7DB17938D53584AAA6005F5685A69370566DD3CA1BA39E844D993904329210C4D475A438974468C622120861E8702E893BA173F3F623EBB973A06FF52792A600
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.`..E......!... .(..........`........@....|e......................................@... .................................L....................t...*...0............................... ......................P................................text....'.......(..................`.``.data...dx...@...z..................@.`..rdata...U.......V..................@.`@/4......@.... ......................@.0@.bss....p....0........................`..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... .... ......................@.0..reloc.......0......................@.0B/14.....x....0......................@.@B/29.........@.....................@..B/41.....N.... ......................@..B/55......t6..0...v6.................@..B/67...........T......|P.............@.0B/80..........Pc......._.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\iconv.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D7CBBEDFAD7AD68E12BF6FFCC01C3080
                                                                                                                                                                                                                                  SHA1:A21C860B81ED158E91B2B921B752F48FDA6D6F1E
                                                                                                                                                                                                                                  SHA-256:AA9EC502E20B927D236E19036B40A5DA5DDD4AE030553A6608F821BECD646EFB
                                                                                                                                                                                                                                  SHA-512:739A2913F882B712A4D20F831530A411081644704B9AE234F4623B4FB2400F6A36486454F6A25DC8676EF5C570D3E23698B9A35BB3C2712DDB7E050661F36924
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z...;...;...;...$...;..H'...;...$...;...$...;...;...;.......;...=...;..4....;..Rich.;..........PE..L......@...........!.................................................................................................Y......DX..<....p..........................,.......................................................D............................text...z........................... ..`.rdata...z..........................@..@.data...|....`.......`..............@....rsrc........p.......p..............@..@.reloc..<........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\intl.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9F95ECE3D2B3909DE4D9147C4D93F976
                                                                                                                                                                                                                                  SHA1:CBF031A011BB6B3CC38D368B2BD0B5A081076AC9
                                                                                                                                                                                                                                  SHA-256:52FFCD48615D9DE3FDB6B5892149263070DE4B349871269FC6E8539F81DFF61C
                                                                                                                                                                                                                                  SHA-512:FA60865BBE4B1D695B66D3697557947CD764B579344BD5AF14369BE33BF4388A010139C021AB44E68A1828122D2749FFB3EEA4CE06FC99911AE44BD71F5AE269
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7..G...........#...8...........................i.........................p......`......... ......................0.......@.......P.......................`.......................................................................................text...t...........................`..`.data...............................@....rdata...!......."..................@..@.bss......... ...........................edata.......0......................@..@.idata.......@......................@....rsrc........P......................@....reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-032HF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):253448
                                                                                                                                                                                                                                  Entropy (8bit):6.548893401641537
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:14D098ED0428C1F530215DF4F7D71065
                                                                                                                                                                                                                                  SHA1:D6FA525E6EC5FD21F618CC90929D2C5E828B41EC
                                                                                                                                                                                                                                  SHA-256:61EA0E0C378AD1BACE6A24B63814596062D8459D7C32B36FAFA6A24447644889
                                                                                                                                                                                                                                  SHA-512:EE294E95305813B4741652E959A0461425F165F1E95A88C3F90E37849D292AD76F858B1CE4F22F36DB5AD99CF465728E89482820729D60A64611D7213DE82A44
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.].v.3.v.3.v.3....u.3.....3...f.3...z.3...a.3.v.2...3.....3...w.3...w.3.Richv.3.................PE..L...!..e...........!.....|...4.......k....................................................@......................... h..(....J...........................*.........................................0)..@............................................text...>{.......|.................. ..`.rdata..H...........................@..@.data....5...p...2...\..............@....rsrc...............................@..@.reloc..T ......."..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-04TMO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):37896
                                                                                                                                                                                                                                  Entropy (8bit):6.712199275280804
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:721DD4941FE03B6158E1878ADF00ED18
                                                                                                                                                                                                                                  SHA1:85A1DD692342B8C6763C5B0289C829DDBED5ACFD
                                                                                                                                                                                                                                  SHA-256:CBA1624A956642DCAB70237424A7C4D3263874FB082A94B27D539B19D25D6C0B
                                                                                                                                                                                                                                  SHA-512:3669FC4D00DD4C55896B98A0A2F79D8C6BDB2B0153FD87566E09197135481639FCCFEAC5D324CA89EBEFE173D472BCDAAADDF0B5E1BAA282C9013998F7577128
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z..Z..Z....U.[..S.V.[..S.G._..S.@.T..S.P.S..Z.....S.I.Y..S.Q.[..S.R.[..RichZ..........PE..L...M..e...........!.....8...........>.......P......................................Pw....@..........................l..m...._..d....................j...*......L...pQ...............................U..@............P..X............................text....7.......8.................. ..`.rdata..}....P.......<..............@..@.data........p.......Z..............@....rsrc................^..............@..@.reloc..B............b..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0TAB9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):43528
                                                                                                                                                                                                                                  Entropy (8bit):6.505908193530498
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EDBC1C401C80E02B7259DB5D06B275A0
                                                                                                                                                                                                                                  SHA1:7D851DD7557DEF029775E346DC6174D84A74267C
                                                                                                                                                                                                                                  SHA-256:2AA315D330DFC59852F9A82F703C746DE393B63E95233AC1806FA8F386CE513B
                                                                                                                                                                                                                                  SHA-512:8FC07438C54AC44B17B8C863CD6C3000E60B81C93467C401391097DEC3681256EBF043B4D49AEDCF62FE2D83980029AE7F53BEAB98471A2CB040EC62BCE92F32
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'.t.F.'.F.'.F.'..c'.F.'.>`'.F.'.>v'.F.'.>q'.F.'.>f'.F.'.F.'.F.'.>.'.F.'.>g'.F.'.>d'.F.'Rich.F.'........................PE..L......e...........!.....B...:.......J.......`......................................>.....@.........................`...c.......<........................*......l....`..............................@y..@............`...............................text...+@.......B.................. ..`.rdata...&...`...(...F..............@..@.data...H............n..............@....rsrc................p..............@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0V2BJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):59904
                                                                                                                                                                                                                                  Entropy (8bit):6.049630833293433
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D4E7C1546CF3131B7D84B39F8DA9E321
                                                                                                                                                                                                                                  SHA1:6B096858723C76848B85D63B4DA334299BECED5B
                                                                                                                                                                                                                                  SHA-256:C4243BA85C2D130B4DEC972CD291916E973D9D60FAC5CEEA63A01837ECC481C2
                                                                                                                                                                                                                                  SHA-512:4383E2BC34B078819777DA73F1BD4A88B367132E653A7226ED73F43E4387ED32E8C2BCAFD8679EF5E415F0B63422DB05165A9E794F055AA8024FE3E7CABC66B9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...X`1G...........!.....:..........rG.......P.....x.........................0............@.................................L................................ .......R...............................S..@............P..,............R..H............text....8.......:.................. ..`.rdata..^....P.......>..............@..@.data...............................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-0VKK6.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1700352
                                                                                                                                                                                                                                  Entropy (8bit):6.821409907895513
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D0AAAE16BA162DD89D646887F1539855
                                                                                                                                                                                                                                  SHA1:0A222F319B7712B861EF6ADF0C38CC2C5A2790FA
                                                                                                                                                                                                                                  SHA-256:D84E7EB505ADEE8EA660F48C89705977F5EB33B7299D0BD981624E3ECE320223
                                                                                                                                                                                                                                  SHA-512:6D7CF7B3A1DC0560791BC3DB4FC836AD0F58B8B531C593D96A37BB77AFA3AB7DD6BD4D66A97E37CDE3443078EB189609D8D36119198C60CE6B74C1A093000769
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9=.XS..XS..XS.r{J..XS..XR..YS.r{...XS.R{O.GXS.r{l..XS..{...XS.R{N..YS.r{n..XS.Rich.XS.........PE..L......;...........!.........`.......r.............z................................7...............................@j..CN...w..x....`..........................hs..h...8.......................................|.......,............................text............................... ..`.data...L...........................@...Shared.......P.......@..............@....rsrc........`... ...P..............@..@.reloc..hs...........p..............@..B..w;8...b.v;E.....w;O.....w;Z.....w;d.....w;n...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ole32.dll.ADVAPI32.dll..............................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-15KM4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):3814
                                                                                                                                                                                                                                  Entropy (8bit):5.51945666273142
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:429C02A9D3D161C6CF1BC7C0D7A79E37
                                                                                                                                                                                                                                  SHA1:425ED89D1B52AD95E80A79DA49057D9E78E0282C
                                                                                                                                                                                                                                  SHA-256:537F3A1CB39892D0D355DFE3C8888EEE7704E3FBF3BE642CDE800F8881065AD1
                                                                                                                                                                                                                                  SHA-512:98930CD2ADF8C459157BD39F4B3AB7B4D8C0A3431016C5492A14622B0DA27268BD2143AFB11D533CE9C810FBDB97C45FFD2179114468C87E9B74D9377E88C34E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<Game name="GTA V">...<Configuration Exclude="Profiles">%USERPROFILE%\Documents\Rockstar Games\GTA V</Configuration>...<Configuration Architecture="x64" Exclude="Profiles">%PROGRAMFILES(X86)%\Steam\steamapps\compatdata\271590\pfx</Configuration>...<Configuration Architecture="x86" Exclude="Profiles">%PROGRAMFILES%\Steam\steamapps\compatdata\271590\pfx</Configuration>...<Data>%USERPROFILE%\Documents\Rockstar Games\GTA V\Profiles</Data>...<Data>%PROGRAMDATA%\Socialclub\Player</Data>...<Data Architecture="x64">%PROGRAMFILES(X86)%\Steam\steamapps\compatdata\271590\pfx\Profiles</Data>...<Data Architecture="x86">%PROGRAMFILES%\Steam\steamapps\compatdata\271590\pfx\Profiles</Data>..</Game>..<Game name="COD Modern warfare 2">...<Configuration Include = "config*.cfg|options.*.cst">%USERPROFILE%\Documents\Call of Duty\players</Configuration>...<Configuration Architecture="x64" Include = "config*.cfg|options.*.cst">%PROGRAMFILES(X86)%\Steam\steamapps\compatdata\1938090\pfx</Configuration>...<Conf

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-19K5L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):291336
                                                                                                                                                                                                                                  Entropy (8bit):6.250861876184112
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:18C17CCB25A0DCC70EBC9064BA677B65
                                                                                                                                                                                                                                  SHA1:123D39C7F2E82E8E8581B0B7082CB2521EBD4D9F
                                                                                                                                                                                                                                  SHA-256:11034AC5097CC70D915052DAA27DE4E1A9F0FECACF6108F6942CBEE0DA5A0179
                                                                                                                                                                                                                                  SHA-512:D884381EECFEFE50F13528D79BD7D1176DFD9A66C8871D77FFA8545DA187A1732E08D8C56B00DDC01EDAAC6EB61C72FB89F2F9C0DBE7E2287558B686AF3772D8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ib..(...(...(..Lg...(...P...(...P...(...P...(...P...(...(..&(...P...(...P...(...P...(..Rich.(..........PE..L......e...........!.....&...................@....................................... ....@..........................%......@........@...............H...*...P..@...PC.............................. ...@............@.. ............................text...z%.......&.................. ..`.rdata..B....@.......*..............@..@.data........0......................@....rsrc........@......................@..@.reloc...(...P...*..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-19TAL.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):106496
                                                                                                                                                                                                                                  Entropy (8bit):5.9050556378057335
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:585353E5EA55A84DBE56C4CFC5829C30
                                                                                                                                                                                                                                  SHA1:2198BE1DE2536AE582D6F496146B9D99608839FF
                                                                                                                                                                                                                                  SHA-256:C3F7890CA7C30C3279B3D7C145CA3F87BFB3621CA2EA027DF7E4BE96405C0DA0
                                                                                                                                                                                                                                  SHA-512:52ED461A17BEEB0FE511C66FF0BE7B339BEB91D59131D72D656E4901549DA43C06189581845708B223FF6754AEADB1F97C3EAB710EE252315EC208B49C142C10
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.G...G...G...%...M...(...E.......C...(...C...(...C...>...D...>...E...G..........D...A...T.......F......F...RichG...................PE..L....F.K...........!..... ...................0.......................................................................J......xA..x.......8.......................8....................................................0..l............................text............ .................. ..`.rdata..#9...0...@...0..............@..@.data........p.......p..............@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-1FUP0.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):146952
                                                                                                                                                                                                                                  Entropy (8bit):6.090997659004551
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7820C310126DB904B2E8CC6A7C59B66B
                                                                                                                                                                                                                                  SHA1:00BFC23D37C78D678AD4FA88F2EB52D263F99879
                                                                                                                                                                                                                                  SHA-256:DFE5912C4E5E88513863BF4A99A6663F40AAF563507CF9ACE41D9F7429444058
                                                                                                                                                                                                                                  SHA-512:1CB7002C30A62A441B070CB1B59D92F4D35BC22562EEC96457D9DEC7C6CF111B571BE812C11E103FFD85DCEEF481E293F157C88EC3CA6C480C1FBCAE5619129C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.8.].k.].k.].k.%kk.].k.%zk.].k.%}k.].k.%mk.].k...k.].k.].k.].k.%tk.].k.%lk.].k..jk.].k.%ok.].kRich.].k........................PE..d......e.........." .....p...................................................`......=.....@.........................................p...........d....@....... ...........*...P..0...@................................................................................text....n.......p.................. ..`.rdata..,_.......`...t..............@..@.data... 7..........................@....pdata....... ......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-1KF51.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):163336
                                                                                                                                                                                                                                  Entropy (8bit):6.625466157784234
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:61CB6B397A69CD2416B1150BA52A6870
                                                                                                                                                                                                                                  SHA1:4605109252B19ACA29E9755839E807A7602D10B7
                                                                                                                                                                                                                                  SHA-256:80E7518B7834B496766997C6C95DF2EE4BB49A81183C1BB80136775E382456D5
                                                                                                                                                                                                                                  SHA-512:F09E8E6D027DC2A760CB424D51CD27CAA92126C51AE06FA31DF0F3A66416AB6121603C76310269D8889496B5C1ACA68706C37B89E14734FFE261A22412563BF3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,.y.....,......,......,......,......,...-.I.,......,......,......,.Rich..,.................PE..L......e...........!.........@............... ......................................B.....@.........................0v..,)...a..x....`...............T...*...p......`"...............................G..@............ ..@............................text............................... ..`.rdata..\.... ......................@..@.data...t...........................@....rsrc........`.......B..............@..@.reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-1NO53.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (502), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):853
                                                                                                                                                                                                                                  Entropy (8bit):5.398298455126033
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:69E6E75B8251A7749435E331E29912A4
                                                                                                                                                                                                                                  SHA1:6467C2F533D43AC6E9154CD4E4A0114CA820AEC8
                                                                                                                                                                                                                                  SHA-256:9A900C1D0801730B675A8C67048F80FDE41AF58D52C72D8545D4A405CD10F4D6
                                                                                                                                                                                                                                  SHA-512:847D7962AF49ACC5C1B8F4E01B917DF029971112163D8A5A42D4BF798B13FABB04E2BBA37257612C52588EE280B29ABB2DCECF02D4B8DB268BC0CF3CCC4B7482
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.ATL" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="ATL90.dll" hashalg="SHA1" hash="f0cf74c20776ac03e144833d21af0b288b9da01b"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Bv2ROMQw5/LTkLmljt9dlJ9XBX8=</dsig:DigestValue></asmv2:hash></file>..</assembly>

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-20SLO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):586240
                                                                                                                                                                                                                                  Entropy (8bit):6.44244461047158
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8ACDBFC9777A604CFECA10F656C0AAEF
                                                                                                                                                                                                                                  SHA1:58B1C08912FB2F1388C69AC747D895D1006A73D3
                                                                                                                                                                                                                                  SHA-256:47FFBE04A61C9011BADD7716AC7B3636C21EB6D0CED549607224779339764147
                                                                                                                                                                                                                                  SHA-512:21C955BA6AA543B0419256DCBB4D2B42376DC361F2FDC475B1E2D907BED006F31A1D8C06C044412B33330BC4A330B44610A3DB908182D75A69275D7BA498FD50
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.].h.3.h.3.h.3...?.j.3..=.r.3.^.9.3.3..l.i.3.h.2..3..n.o.3.^.8..3....H.3....j.3..5.i.3.Richh.3.........................PE..L.....M........../..........f......T.............@............................................................................P.......................................................................................8............................text.............................. ..`.rdata..............................@..@.data............h..................@....sxdata.............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-22GF3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):19136
                                                                                                                                                                                                                                  Entropy (8bit):7.087513588569315
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EAD443B805F5DFDDF6B384B214B28DDB
                                                                                                                                                                                                                                  SHA1:8A82E3603936A6623514D0E707FCB48A5933C0CE
                                                                                                                                                                                                                                  SHA-256:2DA15EB964AB1E82D5ECA744AA1636EB667315F3EF84E365CE556AB8758C3550
                                                                                                                                                                                                                                  SHA-512:49FE8C2602C29D8652B85E46FD178C78615DCBA756A9A7B69EC9248716193DB747C60521B94DA1E50F009F7824C487E5FB1772B9D171F82C6F329E19C0821080
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......).....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDS.O..@..G..Pm.......api-ms-win-crt-conio-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX....4...........................l...............W...............7...P...j...........................,...L...l.......................,...M...o...........T...............>...y...........0...G...b...{...........................D...]...........................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-24FIA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):24256
                                                                                                                                                                                                                                  Entropy (8bit):6.864939507696452
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8F0CB5CA0C982EFCEC40241F81F9CC11
                                                                                                                                                                                                                                  SHA1:3AF0FC542FE2D63EA5ACD117E91DE134FED3B5EF
                                                                                                                                                                                                                                  SHA-256:6147EB7E5BD6AC004301350EF4B168E552B82E301E14DCF3B10DF88D833DC1BE
                                                                                                                                                                                                                                  SHA-512:E6C9EF79F472BD2AE555A9EFB606176674D22FB7BB359F268BC0B572382AF0336694171A3EC4F5CC986F2EEAE63BC0804198715D0494A6C7D58C4160E6E9B966
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!.........................0...............................@......8E....@..........................................0..............."...<..............8............................................................................text............................... ..`.rsrc........0......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDS...1...I.;..........api-ms-win-crt-string-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02..................oX................................'...C..._...|.......................1...P...m.......................+...J...i.......................+...K...l.......................2...S...u.......................(...B..._...}......................./...N...m...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-24OUR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):30216
                                                                                                                                                                                                                                  Entropy (8bit):6.740644340885545
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:605CDBC8313DFF563D1E84EB6C33E0A5
                                                                                                                                                                                                                                  SHA1:0D7F1B9D78D6A6B3FEEE637CEC3505831F9E5683
                                                                                                                                                                                                                                  SHA-256:F1976D608800C13311AAD118AF326763819D3A59A77E4C166AB75AF8BD14DD8B
                                                                                                                                                                                                                                  SHA-512:CDFEA5939CD0A88E7765C6DC9D0613CD848F4024BE76A581D43198B33F3BE7EF73A738AA7893520BA2A1E2AD70E4D27B7C444A583C2DC8CDF0B98289413059C1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$&@SEH.SEH.SEH.....REH.Z=..QEH.Z=..]EH.Z=..WEH.Z=..TEH.SEI..EH.Z=..XEH.Z=..REH.M...REH.Z=..REH.RichSEH.................PE..L...I..e...........!.....$...$......3........@............................................@..........................Q..g...$K..P....p...............L...*..........@A..............................(F..@............@..$............................text....#.......$.................. ..`.rdata..'....@.......(..............@..@.data... ....`.......<..............@....rsrc........p.......>..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-25KT5.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):81928
                                                                                                                                                                                                                                  Entropy (8bit):6.772303716232147
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6D3CBB70C6FD1ECEEB0D5392D4CCC812
                                                                                                                                                                                                                                  SHA1:DA03585F9EC5C522D94ACEE3738729D0511400D4
                                                                                                                                                                                                                                  SHA-256:D593AA615F5BC59D96C9766D573247188D6CE6C253445189F028336F4BBB9082
                                                                                                                                                                                                                                  SHA-512:FDF28E783FA5D9540AAA195FC93478A4903A075A8A7C7B9AD8FBFBCC1A58283E568187765DAFB30F88704FB8120F4AA21287DFC977D04AD998480752A9175430
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........|.sx/.sx/.sx/6<./.sx/.../.sx/.../.sx/.../.sx/.../.sx/.sy/.sx/.../.sx/.../.sx/.../.sx/Rich.sx/................PE..L......e...........!.........................................................`.......Y....@.............................T.......P....@...................*...P......0...................................@............................................text............................... ..`.rdata...%.......&..................@..@.data....P.......J..................@....rsrc........@......................@..@.reloc..N....P......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2BM3F.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):82952
                                                                                                                                                                                                                                  Entropy (8bit):6.335966367146711
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2F776C52668D42AA52635A332CF170F7
                                                                                                                                                                                                                                  SHA1:5C6740A3C6B4A8009EA42C88F6E27A8807E6ECC9
                                                                                                                                                                                                                                  SHA-256:DB62895FEE16CF9DC3F1EE35F94F8BB5711192A7E136929AFFD087A0610E223B
                                                                                                                                                                                                                                  SHA-512:C92C26E79A8AB2A5C4A410B38140045D60E3A14D97426FAEE99C6D60CE307D77961B6817214EB6D195739D0CC433E5EB736652FBACF6135A8D45684D5EADC35D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0..0..0....N.1..9.M.2..9.[.&..9.\.8..9.K.9..0..[..9.R.7..9.I.1..Rich0..................PE..L...[..e.....................H......g.............@..........................P...........@.................................h...d....0...................*...@..0...................................p...@............................................text............................... ..`.rdata...5.......6..................@..@.data........ ......................@....rsrc........0......................@..@.reloc..d....@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2BVR2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):200200
                                                                                                                                                                                                                                  Entropy (8bit):6.341534441265791
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3D750473403027F9E248FE8A3814530F
                                                                                                                                                                                                                                  SHA1:8244DDD0E2F8AD7E340676B73FB60355C6A8AAC9
                                                                                                                                                                                                                                  SHA-256:9E2E8AD29B15B7A818FB9812D4AA553647C5AB6C12C523F20601F769DBE55187
                                                                                                                                                                                                                                  SHA-512:AC5C41537BAF7677D5CF85679E0256C66F450D670AD7B6C40BB2551A869B0AFA4124CE0A52927084BC24A66F354E132567C73DCF90E215092888A43ACD524DA9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.X..X..X......X.. ..X.. ..X.. ..X.. ..X..X..0X.. ..X.. ..X.. ..X..Rich.X..........................PE..L......e...........!.....L...........3.......`............................... ......v.....@.............................v................................*...........b..............................X...@............`...............................text....J.......L.................. ..`.rdata...q...`...r...P..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2CR4U.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):104456
                                                                                                                                                                                                                                  Entropy (8bit):6.462062824075613
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:558C8EBAFD5370F1F64AE13F7D37721D
                                                                                                                                                                                                                                  SHA1:EB4C552874C8331329CF1AD2252BC8C491D941EF
                                                                                                                                                                                                                                  SHA-256:82E6E0B2ACC9662F96F419314EB07B5EC63077B75AA9AB57E888148283B4A2E9
                                                                                                                                                                                                                                  SHA-512:264C8EB46B9E9BEFC257A96C578B439136050BBD0C559A572B7F02D21C613B275735E446B93D4D7D5EB78D9BAD928D8940FAF9A5B965645991E7D37C537CC875
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...3...3...3.,.....3.......3.......3.......3.......3...2...3.......3.......3.......3.Rich..3.................PE..L......e...........!.........L......s........0............................................@..........................e......<N..d....................n...*..........@2...............................8..@............0...............................text..._........................... ..`.rdata...6...0...8..."..............@..@.data........p.......Z..............@....rsrc................\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2E41F.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):3529728
                                                                                                                                                                                                                                  Entropy (8bit):6.1999679256412845
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:13462A0C1B30FEF03C2137891A56A6EB
                                                                                                                                                                                                                                  SHA1:990919E91356632D4710507F4AD7F6FF13DE33E5
                                                                                                                                                                                                                                  SHA-256:DBF83314288394EDBE27E62DCAAB452056184267978D86CCCA5ED0B445651DE1
                                                                                                                                                                                                                                  SHA-512:090B1AFB007F2ED0EAAEC2454D0D3D1206C699DFDAC4E84DABE502B6BFD1C7D40B7F94D915B4F8B3E3F9EDA778B21F23BE17E356ED1CFEBD683883E261DA71DB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.k...8...8...8..~8...8..x8...8..i8...8...8}..8...8...8...8...8..n8...8...8...8.Uy8...8..|8...8Rich...8........PE..L...^.]e...........!.....<'...........&......P'..............................06.....".6...............................0......P4.x....p4.L.....................4..p.. W'..............................0.@............T4.4............................text...1;'......<'................. ..`.rdata.......P'......@'.............@..@.data....K....4..,....3.............@....idata.......P4.......4.............@....rsrc...L....p4......04.............@..@.reloc.......4......84.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2I9A3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with very long lines (356), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):16736
                                                                                                                                                                                                                                  Entropy (8bit):5.569532950859615
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:64FA6A2B969428202B88FE8F68AED572
                                                                                                                                                                                                                                  SHA1:4F62FC2661A68654F960FDF6F1B7E000E720B9CE
                                                                                                                                                                                                                                  SHA-256:932F206929E5F763A35F825326E22569CCDD7D306A729435395D947C9A9E8EC0
                                                                                                                                                                                                                                  SHA-512:C3BEB6A297F4EFFA389EDB8DB0A25A25DD66395D0EC00C589D682BB99EEEA4F8FBE3615BAC63D356099E940B34F3FB72E668D0F30643CCB0382C87746DCF6333
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0"?>.. Encode = ANSI -->..<DOWNLOADER>...<SETTINGS>....<TRY times="3"/>.... winpe3 x86 1,101 winpe3 amd64 2,101 winpe4 x86 3,101,401,10, winpe4 amd64 4,101,401,20, winpe5 amd64 4,101,401,21, winpe x86 3,101,402,11, winpe amd64 4,101,402,22 -->....<VALID id=""/>....<GRAPHICS ui="1"/>....<PROGRESS is_one="1"/>...</SETTINGS>...<OBJECTS>.... x86 -->....<OBJECT id="1" name="BCD" path="Windows AIK\Tools\PETools\X86\EFI\MICROSOFT\BOOT" range="1352972288-1353234431" md5="1fe7f25994f3eddbfa8aaa9d8c56d667" url="download.microsoft.com/download/0/4/C/04C805CC-4C04-4D76-BE80-7D67B951CF73/waik_supplement_en-us.iso"/>....<OBJECT id="1" name="WINPE.WIM" path="Windows AIK\Tools\PETools\X86" range="336336896-450673718" md5="32b2288d84959c879a5aa6af1caa9263" url="download.microsoft.com/download/0/4/C/04C805CC-4C04-4D76-BE80-7D67B951CF73/waik_supplement_en-us.iso"/>....<OBJECT id="1" name="BCD" path="Windows AIK\Tools\PETools\X86\BOOT" range="450674688-450936831" md5="603c40

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2IPO1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):509960
                                                                                                                                                                                                                                  Entropy (8bit):6.701860949650359
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C57F2B95CFD3D69D4CF89C132F66AE58
                                                                                                                                                                                                                                  SHA1:24F721049467FD1C13A4F9ED88CF0F99E66A858E
                                                                                                                                                                                                                                  SHA-256:CC90C9710E05A7D7E5F01549EBB2A7823DC2790A35DF8D53E150B5F947B92B2D
                                                                                                                                                                                                                                  SHA-512:29FEB73F7FBB6A17F6F69657ECA378B3B6A418F27065F97A69F105621EECBDAB02C6411F1C503962C33FB62A05AC5CA398BA459E41624C05832257F6B5D57BD0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................&.s.....a.....p.....v......P...f.....o.....w.....t....Rich...................PE..L......e...........!.....R...H...............p............................................@..........................R..g...4C...........................*......X8..ps.............................../..@............p..$............................text....Q.......R.................. ..`.rdata..'....p.......V..............@..@.data....E...`.......>..............@....rsrc................T..............@..@.reloc...F.......H...V..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2IUFE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):971584
                                                                                                                                                                                                                                  Entropy (8bit):6.964613857967258
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7F8DA89204332DF95CFC41F6E85DC515
                                                                                                                                                                                                                                  SHA1:7E8D71E1F2F9729A52B2938BFDDE69E56E6DE488
                                                                                                                                                                                                                                  SHA-256:1C8449F417566DD0FD69DC21EF77D46B9475FBAAC731DA35BDC71669F22242C8
                                                                                                                                                                                                                                  SHA-512:D48B833CBC9DB97D7BE4E986BE25AE097D1F55A33D591C5F554EC95D0D329F7CDC50687E16429289308A212CB00A8E2A640039CA7A056C5E03F58E21D3B27B33
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0iP.^:P.^:P.^:..:S.^:P._:..^:]L.:..^:]L.:1.^:]L.:f.^:]L.:..^:]L.:Q.^:]L.:Q.^:]L.:Q.^:RichP.^:........PE..L......V.........."!......................................................................@.........................`........R..(....p..................@?......\]......8...........................0...@............P...............................text............................... ..`.data...De.......V..................@....idata.......P......................@....rsrc........p.......2..............@..@.reloc..\].......^...6..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2J85E.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):506376
                                                                                                                                                                                                                                  Entropy (8bit):4.078572056519636
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9A38273330B2E77557DD4D0E5AD6686E
                                                                                                                                                                                                                                  SHA1:49259ADCB20622A47666A0F72EAF8E2DD47D20B0
                                                                                                                                                                                                                                  SHA-256:32329988C7714DA48ED040D413495C4A7C42C8AB8E5025BFCEA6A4DD17FA053F
                                                                                                                                                                                                                                  SHA-512:30F5DB67B073D4332ED9A1EA10B955CD8814D8AA4B5E1E1281BF625FB381A4DFD57EF863FD169252B3DC84069A197708747A9A3CA82F66DA3E5E9390641179A2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.....c...c...c.....,.c.'...&.c.'...!.c.'..+.c.'..%.c...b.E.c.'..*.c.'../.c.'../.c.Rich..c.................PE..L...F..e...........!.....v...........u.............................................../....@.........................PP......LA..x........................*......|..................................X2..@............................................text...gt.......v.................. ..`.rdata...............z..............@..@.data....C...`...<...@..............@....rsrc................|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2NS56.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Windows setup INFormation
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):3392
                                                                                                                                                                                                                                  Entropy (8bit):5.006890884430044
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D479620907D07C0051906C48ABC88F37
                                                                                                                                                                                                                                  SHA1:4D03604958DDA1AC63BE65239E71ECEE384F1870
                                                                                                                                                                                                                                  SHA-256:3667132E03E0172FFF75D6DE245CC04D35B56D0ECD81B6BCFA9E8B225B75F230
                                                                                                                                                                                                                                  SHA-512:DB8618D674E7C15CF46C0F10F7FA2B3A0C7F1EF53D53DDFC2184FEADD27C0C351F5728BBA7693DFB0B2FD14C2CF5FC575A67FAC684B8B4AB41825781A3ECECB2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:;;;..;;; euimgprt..;;;..;;;..;;; Copyright (c) 2001, Microsoft Corporation..;;;....[Version]..Signature = "$Windows NT$"..Class = "ActivityMonitor" ;This is determined by the work this filter driver does..ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2} ;This value is determined by the Class..Provider = %Msft%..DriverVer = 06/16/2007,1.0.0.0..CatalogFile = euimgprt.cat......[DestinationDirs]..DefaultDestDir = 12..euimgprt.DriverFiles = 12 ;%windir%\system32\drivers..euimgprt.UserFiles = 10,FltMgr ;%windir%\FltMgr....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..CopyFiles = euimgprt.DriverFiles, euimgprt.UserFiles..DelReg = euimgprt.DelRegistry....[DefaultInstall.Services]..AddService = %ServiceName%,,euimgprt.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..DelFiles = euimgprt.DriverFiles, euimgprt.Use

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2P5OL.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):64008
                                                                                                                                                                                                                                  Entropy (8bit):6.950521535712992
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4482955FF45B98CC3C277717E7CF624F
                                                                                                                                                                                                                                  SHA1:27241D8AF1231ACAA3E2340D156D58FA76571E34
                                                                                                                                                                                                                                  SHA-256:BEC0BDD614DE66FDD5AA47CC5561CE69EAAF9E82C5977F2C71246A774532D1BE
                                                                                                                                                                                                                                  SHA-512:5CCCC0B561DA71DBA78231ABF57960EBCFC13FA919170D1DAAFD1AD3F9BFD0CA2A875479A4597B1730E2D7D7CE13395CAFC5EF7CC6AFFCCBE2714010A51E7433
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'..'..'...w.&....t.$....b.)....e. ....r. ..'...Z....k./....s.&....p.&..Rich'..........................PE..L...:..e...........!.....l...`......vo...............................................4....@......................... ...........P........................*.............................................@............................................text....k.......l.................. ..`.rdata...J.......L...p..............@..@.data...............................@....rsrc...............................@..@.reloc..j...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-2Q3GA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1385992
                                                                                                                                                                                                                                  Entropy (8bit):6.75210494640825
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5BB7638E18ECD54AA8EC5BB24BD4B9E3
                                                                                                                                                                                                                                  SHA1:D3773E9B2274C986986A6491025FB66A33F6F6AD
                                                                                                                                                                                                                                  SHA-256:FB4A6AEE3FB97EB50DB9593F64CE60189CA8C83E8A87593E7D26B158466D4EA2
                                                                                                                                                                                                                                  SHA-512:707ACA012492501EED6258B342CE8933630EDDF213E44EF904C5A1114F4493273B853D96042CEC798ACB80B578BE9E195FDEBBF0EA714DE2F64B544B61E4EFF9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$qk.$qk.$qk.>..'qk.-...:qk.-...cqk.-.../qk.$qj.qk.-....sk.-....qk.-...%qk.-...%qk.Rich$qk.................PE..L......e...........!................./.......................................p............@..................................s..d....p...................*...........................................W..@...............T............................text............................... ..`.rdata..R...........................@..@.data...H............v..............@....rsrc........p......................@..@.reloc..l...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-30V1U.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):79368
                                                                                                                                                                                                                                  Entropy (8bit):6.37885627704374
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DBFC1A7ADC822D7803FA886F4C60ACE3
                                                                                                                                                                                                                                  SHA1:C86E723F007528B93DAA5FD898BF94CA1F42832C
                                                                                                                                                                                                                                  SHA-256:E870A9809593C480F8099BF8FD49CA0CB6C5F61E252DEAD6E539B3FB14B1C526
                                                                                                                                                                                                                                  SHA-512:265177626AC31CA28A5CA9BEDEFA101A173B5826CC20D7498E50059F15294A0CC12A49614B7D17528C34056607CE82CECFC662C62D92A6FE59ED87656C355A2B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0].DQ3EDQ3EDQ3E...EEQ3EM).EBQ3EM).EJQ3EM).EMQ3EM).EOQ3EDQ2E.Q3EM).EAQ3EM).EEQ3EM).EEQ3ERichDQ3E........................PE..L......e...........!.........j...............................................@.......k....@.....................................x.... ...................*...0......@...................................@............... ............................text...c........................... ..`.rdata..UR.......T..................@..@.data...8...........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-31S3C.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):243208
                                                                                                                                                                                                                                  Entropy (8bit):6.206010583786375
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3EC47A9822B1AE803690424FD84DC969
                                                                                                                                                                                                                                  SHA1:8BA8B4F320A9AF651AE653ABEB6EDD1A1EACE1FF
                                                                                                                                                                                                                                  SHA-256:3CE8F0A358B031E7CDD8026E3F99EC4832799AC6CCA95786F5AFE3D9CA04353F
                                                                                                                                                                                                                                  SHA-512:3BD4655C51B3167729AFA40B07B025819973208507CD80E1A3E035122B2E00F4427719762E1FA4F255C8F2B2FF74DD3BD5E0F7D91FA1F038056698940F66499D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:..:..:.....8..3...>..3...4..3...1..3...5..:.....3...2..3...;..3...;..Rich:..................PE..L...[..e...........!.....h... .......T..............................................9.....@.........................0p.......S...........................*..........0...............................x(..@............................................text....f.......h.................. ..`.rdata...............l..............@..@.data................^..............@....rsrc................f..............@..@.reloc...!......."...j..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-33791.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):50568728
                                                                                                                                                                                                                                  Entropy (8bit):6.11870822543902
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:863D8AA78CF008801B9ACFA66121E5DA
                                                                                                                                                                                                                                  SHA1:59429362D2EC4220D654785213618C78154A7387
                                                                                                                                                                                                                                  SHA-256:4DB4BAE7443EC161A36950C91EDF080BB19E2A78FA25B6CB0215BDDA60D4BF38
                                                                                                                                                                                                                                  SHA-512:7DB17938D53584AAA6005F5685A69370566DD3CA1BA39E844D993904329210C4D475A438974468C622120861E8702E893BA173F3F623EBB973A06FF52792A600
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.`..E......!... .(..........`........@....|e......................................@... .................................L....................t...*...0............................... ......................P................................text....'.......(..................`.``.data...dx...@...z..................@.`..rdata...U.......V..................@.`@/4......@.... ......................@.0@.bss....p....0........................`..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... .... ......................@.0..reloc.......0......................@.0B/14.....x....0......................@.@B/29.........@.....................@..B/41.....N.... ......................@..B/55......t6..0...v6.................@..B/67...........T......|P.............@.0B/80..........Pc......._.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3BJOU.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.083495436475453
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:893CCBB69C80F31E4113FEE262899556
                                                                                                                                                                                                                                  SHA1:6DB45D32CD313AE052FB6186573C5657852C3E80
                                                                                                                                                                                                                                  SHA-256:6B74E4CF18B07D6018E4C2AE561E9A37AB9E1FEBEFF06EAD44125CF1B070F372
                                                                                                                                                                                                                                  SHA-512:EFFBFFD7E9D24BE133F0AB888203A223DF8942D396C99C962132C2DE48CA8ED0218631C4B8D6BD29874C30643FB589D91E20132E27CD457CE5CA1ED8A68ECDD5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......A....@.............................+............ ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........;...8...8.......^*oX........d...t...t...RSDS......RI.:@c...x....api-ms-win-core-console-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................@...x...............7...q...............'...O...{...........................$...S...................B...e...........................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kernel32.AllocConsole.GetConsoleCP.k

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3DHJ8.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):25792
                                                                                                                                                                                                                                  Entropy (8bit):6.781147827456816
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:55CE323CCBC72920750D305C0B2A09C4
                                                                                                                                                                                                                                  SHA1:8C51F65875CCE5C049078FE0209A9A9D1CB98031
                                                                                                                                                                                                                                  SHA-256:86CC087D197B1243413C0963B6F132648489FE26A4A11A7A77163744810E9165
                                                                                                                                                                                                                                  SHA-512:B760A985F6FC895CCB0D9E0D99D4215CBC90F5D85DFCF46D96DC727C3E5CCEA424D8B04C21FAE8E2F32127BB6B4E1D63B3AC43BD21B22859D3C6941C8052AFA9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!....."...................@...............................P............@.............................. ...........@...............(...<..............8............................................................................text....!.......".................. ..`.rsrc........@.......$..............@..@.....0oX........<...8...8........0oX........d...t...t...RSDSZB ...7D..... ....api-ms-win-crt-multibyte-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02..................oX........................(...H.......0...R...u...................$...G...k.......................A...f.......................5...X...{...................*...M...p.......................=...^...}...........................Q...t................ ..# ..F ..i ..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3GEFV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):32776
                                                                                                                                                                                                                                  Entropy (8bit):6.816050374291968
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F64C1464CF3055B2316C0D42693BC366
                                                                                                                                                                                                                                  SHA1:2BB026E6F79F1A055529A12324CBBEABF7827796
                                                                                                                                                                                                                                  SHA-256:BE1087A063792B07CB5805836E799344FAEDAD6BA2ACFAE53A286DE4070BE1F5
                                                                                                                                                                                                                                  SHA-512:FB49744644F035A754A1C5F86B1148A1A61D432E121A65BB16EDAFF13668A91ABCE6E4B42ED3FCE3C65666BA5CC9C9AFDE9863347A0E039A160EA2E0CBE8E06C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{...?...?...?.....k.=...6.h.>...6.~.1...6.y.;...6.n.:...?.......6.w.=...6.o.>...6.l.>...Rich?...........................PE..L......e...........!.........:....... .......0............................................@..........................9..n...L5..<....................V...*...........0...............................1..@............0...............................text...F........................... ..`.rdata.......0......................@..@.data...8(...P......................@....rsrc................L..............@..@.reloc.."............P..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3K905.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.112182129935938
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EB9161FD0B8137D2C43BBE7C646C8E3C
                                                                                                                                                                                                                                  SHA1:F41E6E7302B4BDE1281F583A5C4FD5FE7B03F2E3
                                                                                                                                                                                                                                  SHA-256:9E4F1D09A2471FF46B5BB2D9FDDB0BC04143398D14341D11423A7589796413F7
                                                                                                                                                                                                                                  SHA-512:F733062E46F46DBE85A21868AE0E5304E13C645C26E57D0CBA905BCD23C872B68F07A9813B4F55FCDDCF67475D649D5833D893B27D1FF3756D3F4DEEA0BDC785
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......?6....@.............................L............ ...................<..............8............................................................................text...,........................... ..`.rsrc........ ......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDS..W.r.nO...&.m.....api-ms-win-core-file-l1-2-0.pdb.........8....rdata..8........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02......................oX....0.......................(...\...~...........P...q...................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMountPointW.GetVolu

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-3QBU3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):96776
                                                                                                                                                                                                                                  Entropy (8bit):6.304716378817214
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BA57BE04E0A730C8168A73FC174F8DBF
                                                                                                                                                                                                                                  SHA1:BCDBCB5C57CDC90565E5EEF6B9B408B7F3FB7B78
                                                                                                                                                                                                                                  SHA-256:7F656D54F3FF291331F0DA61B1EFECAED3A7043DF388CDD4530281A48F9AA215
                                                                                                                                                                                                                                  SHA-512:AFEF19CF43BCADA9DCF4EA35C1722BFC143AE5DDD422555075D43BF00040ABEF3E8020ABD6D1371DDE1F52BF72A2EF9D61D5C8423804A5053FF470D87078F830
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.x.v...v...v.....w......u......x......|......y...v.........}......w......w...Richv...........PE..L......e...........!................................................................N....@..........................?...............`...............P...*...p......`...................................@...............4............................text.............................. ..`.rdata...p.......r..................@..@.data...4....P.......2..............@....rsrc........`.......6..............@..@.reloc..f....p.......:..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-47EEO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):116736
                                                                                                                                                                                                                                  Entropy (8bit):6.66331198622302
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:299692A9E5ABD161B2BC22BCBF352CF0
                                                                                                                                                                                                                                  SHA1:731C2052E69CCEDD727655E8AE46D30BAE5162D3
                                                                                                                                                                                                                                  SHA-256:E781227A9281F05CE385545ED7B3FA99798D46D394966DEAB881A2E361E596FA
                                                                                                                                                                                                                                  SHA-512:2EFD124778351B4263F14E4F6BB45BA693CA9B9711E6F09F152C2F811C9AE07CF6BC54176984F679FCDBD7807E9702362F82B11BE58333D2669FAFD3438286F8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........eO.j...j...j.......j.......j.......j.......j.......j.......j...j...j.......j.......j.......j.......j..Rich.j..........PE..L...T.<`...........!.........................0............................................@..........................u...C...........................................q......................`r.......q..@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-48G08.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):20672
                                                                                                                                                                                                                                  Entropy (8bit):7.012197121184615
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B3F20781C32907A02B16C8E8E2A32E74
                                                                                                                                                                                                                                  SHA1:615E9A72372C69583D0C53E461554EAE1368D34A
                                                                                                                                                                                                                                  SHA-256:DC7F41906EDF362829B5E9157BA0C1DA73CE32F95B4CB468CCE96521C4C4AC8C
                                                                                                                                                                                                                                  SHA-512:F928A79699AF5B89D674DAF8915C7321FEEBDD0BA30F611228A88C9781CE2DA3C99A724CC8385FE721556126871522B53D149118F747749E665A0754FBDFE15E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!......................... ...............................0.......G....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@.....0oX........7...8...8........0oX........d...p...p...RSDS...['.H.D.w.......api-ms-win-crt-time-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX............H...H.......(...H...........<...Z...x.......................6...S...n.......................$...A...^...{.......................B...c.......................&...K...p...........................K...k.......................%...E...^...y...........

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-49VCE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):111360
                                                                                                                                                                                                                                  Entropy (8bit):6.312493264120418
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C858E0419781533BF494535985E6B0B8
                                                                                                                                                                                                                                  SHA1:844DADD0887E9C8F595B42BF1F3055433BF87F0A
                                                                                                                                                                                                                                  SHA-256:1E2E67E55DF15EAB387ED40DDE380B696DEF9DAF30FBCA90F746EE29422303EB
                                                                                                                                                                                                                                  SHA-512:BDE01682AE0785D7035A5329B22FA212022666FC031AF5E20EBEC94D616CC81EDF74F1886D819300320CD843CCF6F53D3FDE68644055564C59C1FD0767E3B108
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.B.'...'...'.."h*..'..._)..'..._8..'..._?..'..._/..'...'...'..._6..'..._...'..._-..'..Rich.'..........PE..L...3xUe...........!.....(...f......S........@......................................1@....@......................... ...f....y..d........................!......D....B...............................W..@............@..P............................text....&.......(.................. ..`.rdata...G...@...H...,..............@..@.data................t..............@....rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4A6QT.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):163848
                                                                                                                                                                                                                                  Entropy (8bit):6.3881633254361265
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9F34D4A6052CC948403D5B527B310B77
                                                                                                                                                                                                                                  SHA1:73B639F7567AF73D79182973A9358C0B5BC975D2
                                                                                                                                                                                                                                  SHA-256:606A93915BCAA8082675A3062DEA28297D36DEECD94DE8329979F64A7F2224B7
                                                                                                                                                                                                                                  SHA-512:961A91F50386CF2CCF00BA9817049ACE0993BAA0001AA16A500C7131B435F3032482596D06169981EFBFC5ED64B20809A6B67378A9BED4AC9879BF59EAEAD27A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\..a.a.2.a.2.a.2..J2.a.2..I2.a.2.._2.a.2..V2.a.2..O2.a.2.a.2.a.2..X2.a.2..N2.a.2.3H2.a.2..M2.a.2Rich.a.2........................PE..L......e...........!.....t...........o..............................................<.....@..........................K..g....A..x....`...............V...*...p..\.................................. *..@............................................text....r.......t.................. ..`.rdata..............x..............@..@.data........P.......4..............@....rsrc........`.......:..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4ACJ3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):127488
                                                                                                                                                                                                                                  Entropy (8bit):6.244714020013074
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:96995DE4513551D49808B34B40FFB26A
                                                                                                                                                                                                                                  SHA1:1DAF57AAEA01D60BDB7C63FAF18A419DF955E321
                                                                                                                                                                                                                                  SHA-256:F0D0157B4F1F0FA5AA0C4682EC659CE5E1C61585E631A14536BEA10FAF0B01EA
                                                                                                                                                                                                                                  SHA-512:CFD3B3E8250804D4D4C77BD49A3674FF910AC4C401FB21E5F6F6108916248F88971269202BB26D3FFD4AA987008D2DAFD67430D1D55097610B8F907FFB398181
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.B..........."...8..........................lh.........................@................ .................................t............................0.......................................................................................text..............................`..`.data...0...........................@....bss.....................................edata...................................idata..t...........................@....rsrc...............................@....reloc.......0..................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4EHV1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1039368
                                                                                                                                                                                                                                  Entropy (8bit):6.571245883495837
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9B1D997829392439031F23E58C6A883F
                                                                                                                                                                                                                                  SHA1:55C6E7C7047966B1F8DE47189807C98E3D3CCEF6
                                                                                                                                                                                                                                  SHA-256:CC2EB47E5AC44661DBAA111B0F509826EB52A382B10193637471807709BF7646
                                                                                                                                                                                                                                  SHA-512:E385081AC2225EF849AC9FEADD08139B75A11D2B77C685920F1C8222B45EEC5AE45108611CAB43780C949F788FEAF73B9D53827EB4DC8146F6899B4EE277BEDE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............\...\...\{.H\...\.K\...\.]\...\.Z\...\.M\...\...\...\.T\...\.L\...\.O\...\Rich...\........................PE..L......e...........!................9p....................................................@.....................................x........................*.......K..0................................_..@............................................text............................... ..`.rdata...6.......8..................@..@.data....`.......X..................@....rsrc................L..............@..@.reloc.."`.......b...P..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4JL1E.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):290824
                                                                                                                                                                                                                                  Entropy (8bit):6.297554351566209
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5B3CF9568F67B27CAF772268047D32AA
                                                                                                                                                                                                                                  SHA1:75F4218BD9D895582400A432DB3D3C81B82D7CA0
                                                                                                                                                                                                                                  SHA-256:82901D64767C47A44D99860BEFC91FDBD1CF17FA5DF4FCB8685EF136A4F5AA9A
                                                                                                                                                                                                                                  SHA-512:896512B7ACF67A767B845C4D325DCF73538B0A912D8B39BC716331533699728FE386677200E97CD48E0E9BE18793A92340174C8B504B65E0495E236E74A5B05E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R].R].R]...].R]e..].R]...].R]...].R].S]..R]...].R]...]..R]...]..R]...].R]...].R]...].R]Rich.R]................PE..L......e...........!.........................................................p......._....@..................................m..........(............F...*...@..|(..................................@...@...............D............................text.............................. ..`.orpc...<........................... ..`.rdata..I...........................@..@.data...8............p..............@....rsrc...(...........................@..@.reloc.......@...0..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4NOHR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):20160
                                                                                                                                                                                                                                  Entropy (8bit):7.040409022786182
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A14512897863D230DA2147991A87EFD6
                                                                                                                                                                                                                                  SHA1:7F2001BCAEC0E1F592C584B8EA2B4141C5A191A5
                                                                                                                                                                                                                                  SHA-256:A63EC18946C80414C286DA083A8F8ED36C12B7B37B9B87C574E7AB85E76CAD53
                                                                                                                                                                                                                                  SHA-512:550E0F7ACE356535821D369833DF705D711FD26138952BABD180871EE588CCBF71FA680A3892948801226B1F151DEBD7D2CF051DD41F313B1E9B18ABE4DAC693
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0...... .....@.............................V............ ...................<..............8............................................................................text...6........................... ..`.rsrc........ ......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDS!}."..F......y.....api-ms-win-core-synch-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02..................oX............)...)...........P...........C...m...................&...M...r...............8...p...........;...k................... ...I...w...............1..._...................;...t......................./...`.......................>...e...............#...

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4OV1T.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):44888
                                                                                                                                                                                                                                  Entropy (8bit):6.205334497078457
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0D889654D6F4A8DE9406F6E023862840
                                                                                                                                                                                                                                  SHA1:F66A6273113A13D6742FF47870F2CFE27D02CBB7
                                                                                                                                                                                                                                  SHA-256:467D5CD9C2D86C951DD94D68E3C410FA4F88611EB128B8243B699BB4A5370327
                                                                                                                                                                                                                                  SHA-512:C6A81F7A7C7A9DEE9620278F0AE179763CEF173CD88EA6DA4F3DB266F7C31953B1FC8BF266AFACD33669156A5D7AE2FF9946497E436F87711647462B797FA2F0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H.e...e...e..~*L..e....O..e....^..e....Y..e....I..e...e...e....P..e....H..e....K..e..Rich.e..........................PE..L....b.S...........!.....t...,.......x....................................................@.............................k...L...........................X.......h...`...................................@...............@............................text...0s.......t.................. ..`.rdata...............x..............@..@.data...............................@....rsrc...............................@..@.reloc..N...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4PTPN.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):104680
                                                                                                                                                                                                                                  Entropy (8bit):6.391074407856558
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:53A82E80B8AB0B1936D1049AA8CFD4ED
                                                                                                                                                                                                                                  SHA1:A577DBC08822FF6DCDA187A7C3CC2A5DC9A60212
                                                                                                                                                                                                                                  SHA-256:C1372C8B1B6EDDD8C3E7FABBDB1669F6C7B498C2DA00FB0FE53832509F3DC2C8
                                                                                                                                                                                                                                  SHA-512:55AA88ED9D7C0B03BB0A6CBDCCF12ED2647C690CED9E776B6B882D36FEFCD5FC48705A31AEEC256C4BB5C6EE56DD772E6F8E73F2037177A2B3D633145130FAD6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.e3a..`a..`a..`..`c..`h..`p..`h..`...`h..`Q..`F"f`b..`F"p`h..`a..`...`h..`c..`h..``..`Richa..`................PE..L....~T.....................j.......o....... ....@.......................................@..................................S..d....................~...............!...............................E..@............ ...............................text...4........................... ..`.rdata..J=... ...>..................@..@.data....-...`.......R..............@....rsrc................b..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-4SO60.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):22720
                                                                                                                                                                                                                                  Entropy (8bit):6.940836577231908
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8C137389AFCCACCCBE5864FBA3464F48
                                                                                                                                                                                                                                  SHA1:FB99931A34143B93E5E7A72166AF830BBB389157
                                                                                                                                                                                                                                  SHA-256:8AFDAF1C630AECB97AB5625AC8483664643C526BD705DECFAE0DAAF2481F0A81
                                                                                                                                                                                                                                  SHA-512:4723F709483BC62B4200A5E5CC48C8AF77994B0D06D0DFA3737AD40CB20099DB4BCDF69EDFAAB7F315E1CDF47866FEB473BB4F1D26B25F5823F1A2EA2E1A04CD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!.........................0...............................@............@..........................................0...................<..............8............................................................................text............................... ..`.rsrc........0......................@..@.....0oX........:...8...8........0oX........d...t...t...RSDSx..&...M..[.........api-ms-win-crt-runtime-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02..................oX....6.......k...k...........`...^...{...................#...C...d.......................7...Z...}.......................>...V...o...................6..._.......................:..._...z...................U...............>...............1...R...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-505CN.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):125272
                                                                                                                                                                                                                                  Entropy (8bit):5.155650966130659
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:386CB149DCFA03483F09A8CF8DC4C9A9
                                                                                                                                                                                                                                  SHA1:F7A00E8E1D28B089D63EB2AFC10475673439CAC6
                                                                                                                                                                                                                                  SHA-256:DA4246B98BF072534A8581BF2FBD1E189D5521A8C44FD154999300B331746E0C
                                                                                                                                                                                                                                  SHA-512:A5203F56DF5FAA3626058BC82D2C8358AA64E6F7FE74983B2C2070BD49558E75E18F822A81231687049AF27F9AB6AAF877871F3357D712936BDF49674E1C3C54
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y....z...z...z..5...z.......z.......z.......z...z..%z.......z.......z.......z.......z..Rich.z..........................PE..L...(.&R...........!.....$..........t........@............................... ............@.............................Q.......P.......................X........... E...............................T..@............................................text....".......$.................. ..`.rdata..1[...@...\...(..............@..@.data...`6.......*..................@....idata..............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5292O.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1156600
                                                                                                                                                                                                                                  Entropy (8bit):6.52546095742681
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:462DDCC5EB88F34AED991416F8E354B2
                                                                                                                                                                                                                                  SHA1:6F4DBB36A8E7E594E12A2A9ED4B71AF0FAA762C1
                                                                                                                                                                                                                                  SHA-256:287BD98054C5D2C4126298EE50A2633EDC745BC76A1CE04E980F3ECC577CE943
                                                                                                                                                                                                                                  SHA-512:35D21E545CE6436F5E70851E0665193BB1C696F61161145C92025A090D09E08F28272CBF1E271FF62FF31862544025290E22B15A7ACDE1AEA655560300EFE1EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.R."..."..."......"......."......"...p^.."..\m[.."...pX.."...pN.."...pI.."......"..."...!...pG.>"...p_.."...pY.."...p\.."..Rich."..................PE..L....`1G...........!.....T...N......C+.......p....^x................................g.....@..............................f......x.......x................#.......... ..................................@...............@...........................text....R.......T.................. ..`.data....j...p...H...X..............@....rsrc...x...........................@..@.reloc...1.......2...P..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-59S61.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1034248
                                                                                                                                                                                                                                  Entropy (8bit):6.428804016881258
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:996A97B9A60144C7E72B9B9EE5F1541A
                                                                                                                                                                                                                                  SHA1:8CF5B6444BD6D3BAEEE2FF11E8EE6722C6092399
                                                                                                                                                                                                                                  SHA-256:7417C4F698DC2B5AA5745772563E5DA6709C6205980BC35F548A6D3B33648578
                                                                                                                                                                                                                                  SHA-512:CCF28C28A2D09F0EAF5C375116D519B3AE4EFB003F5A4752C9CC4D135AC45A2D95CBF18906FB254D1FEAFDEE68354B4604EF8359EEDA219DE1AD56AFFF1D2A82
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...6_..6_..6_B.._..6_..._..6_..._..6_..._..6_..._..6_..7_[.6_..._..6_..._..6_._..6_..._..6_Rich..6_................PE..L......e...........!................m................................................`....@......................... )..........x........................*......(=......................................@............................................text............................... ..`.rdata...P.......R..................@..@.data....)...P.......(..............@....rsrc................F..............@..@.reloc..pO.......P...N..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5ARLJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):228872
                                                                                                                                                                                                                                  Entropy (8bit):6.343001265826585
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:435CC5606E526349CAB3FEF8FABF2B1D
                                                                                                                                                                                                                                  SHA1:9915847C87D829C621C0530BEDC0AFA0C9769923
                                                                                                                                                                                                                                  SHA-256:639136DEC38E95D274C6AD4DE1AEF9B3FE6756C5BAA7FC9EEB03A44436919F54
                                                                                                                                                                                                                                  SHA-512:1BA206F292A851950F3CD4D8C6B5F1384320A1645D6C8035511DFE4BFC747DE2CC6743CE2667FAFD3A070CBB98B8B3585FB69CD4CB43F9FD86A610A3B686ED2B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4.{mg.{mg.{mg...g.{mg..if.{mg..nf.{mg..hf.{mg..lf.{mg..lf.{mg.{lg.{mg..if.{mg..hf.{mg..mf.{mg...g.{mg..of.{mgRich.{mg........PE..L......e...........!................................................................s.....@..........................0.......1..,....P...............T...*...`..@...P...T...................H...........@............................................text.............................. ..`.rdata...m.......n..................@..@.data........@.......2..............@....rsrc........P.......<..............@..@.reloc..@....`.......>..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5BR6G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):278016
                                                                                                                                                                                                                                  Entropy (8bit):6.642930441248374
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2ADF12B81A639F2B4325E3DED91FCC55
                                                                                                                                                                                                                                  SHA1:2642775D87866A2B56507606466147B043FC464A
                                                                                                                                                                                                                                  SHA-256:98AE799CBB9A49CA6B2847FE7AD7E72CE2CDCCCF39CC9B29918B8B3589F7D8A8
                                                                                                                                                                                                                                  SHA-512:4BE63B91D649360AD1B9C2BFD28456D1F76FDF70F8D8EEA99EF93B2365F56A9A51AB3AECA8CF9451474A6076350E508A9AA6B96861493D13C81F592C10A096D6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.@.>...>...>.......>...l...>...l...>...l..q>.......>...>..C>...l...>...l...>...l...>..Rich.>..................PE..L...y.}M...........!.................{..............................................3.....@..........................N......D<.......@.......................P..(,......................................@............................................text............................... ..`.rdata...,..........................@..@.data...HD.......(..................@....rsrc........@......................@..@.reloc...8...P...:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5CGGI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):219656
                                                                                                                                                                                                                                  Entropy (8bit):6.493074208244148
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:32D63E48026263BAE3C6965468E825D5
                                                                                                                                                                                                                                  SHA1:ABFBB456F827450DE67F228A0B796E7B39E2099C
                                                                                                                                                                                                                                  SHA-256:A7691EAD24DE3AA4C0B2BD13523BE406DF7EEE6815254BF7CED0376FE0516E7D
                                                                                                                                                                                                                                  SHA-512:7488E617E2B637692D586C73BBD11C34CC4109C4B79303A974AB9AAA14088072658FDC4B238C9F91B93E69896E885A48A008FEF85A641155C72677A418A6CE95
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%..gv..gv..gvs..v..gv..v..gv..v..gv..v..gv..fva.gv..v..gv..v..gv..v..gv..v..gvRich..gv........PE..L...5..e...........!.........................0...............................p......RD....@.........................0...g.......d....0...............0...*...@.......2..................................@............0..t............................text...z........................... ..`.rdata.......0....... ..............@..@.data...\2.......0..................@....rsrc........0......................@..@.reloc...#...@...$..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5DOTB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):100360
                                                                                                                                                                                                                                  Entropy (8bit):6.559818067956113
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:268EC97741E5D4D7F5348C7AA7C3427F
                                                                                                                                                                                                                                  SHA1:66693831BC2449434769C4395D475443E82E7358
                                                                                                                                                                                                                                  SHA-256:CB87FD42384E45A962FAD65AA6C785A2BFF1B270845A2A4C7AB44A4BD3EAEF7C
                                                                                                                                                                                                                                  SHA-512:8E0EACF6CC6B6C2829046F37D70E16EF84DA5E51C1643F3AEA4EA56721E7469A618B9412603F9A6281A20F055598DDFCDC6494CA53710CF306475CF79887D11C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\...2...2...2.....2......2.....2...3...2.....2......2......2.Rich..2.........................PE..L...|..e...........!.........h.......P...............................................?...............................H......l>..x....................^...*...........................................1..@............................................text............................... ..`.rdata...9.......:..................@..@.data....1...P.......0..............@....rsrc................B..............@..@.reloc..F............D..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5IHER.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):166920
                                                                                                                                                                                                                                  Entropy (8bit):6.329901901083376
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:68031243D885BD56976B0539B9A100FD
                                                                                                                                                                                                                                  SHA1:84BEB4ECD145FC98597FC640E474BA53035662FB
                                                                                                                                                                                                                                  SHA-256:376FC2083360E56DBB35C02086125621F112F2812E635D15686357DD9EB3F960
                                                                                                                                                                                                                                  SHA-512:1488727963B254CB5111896E6B9787E9460A8110BBBD6B8E78253D7289AAAE4CDE9452DAC9C1920C7547A2D4140C1EBDDDCB2934689B2BDDF33550C372F8B970
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!D..rD..rD..r...sH..r...sF..r...sX..r...s@..r+..sB..rM.ErJ..r..sF..r..sM..rD..r...r..sB..r.)rE..rD.ArE..r..sE..rRichD..r................PE..L..._..e..........................................@.................................WB....@..................................I..h.......@............b...*..............8...............................@............@...............................text............................... ..`.rdata..[A.......B..................@..@.data........0......................@....idata...H...@...J..................@..@.tls.................\..............@....00cfg...............`..............@..@.rsrc...@............b..............@..@.reloc..,............P..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5K5HA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Generic INItialization configuration [DHCP]
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1307
                                                                                                                                                                                                                                  Entropy (8bit):5.602258760415739
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0633946446DE67F3C969E7CBE3ACD57B
                                                                                                                                                                                                                                  SHA1:70D6CD9DA51C68BB9EF0CF5D4A85A267CB9418F8
                                                                                                                                                                                                                                  SHA-256:97E06B24456A0FA2DA3CCECC959D0AB72F9524FB22A2EADCBB70A867883459B1
                                                                                                                                                                                                                                  SHA-512:8B16CCD2384A48F1DBA8B140FF3FB68B8817168DF4A3E20B27A85F9CA1DDADC7215C99C601C0DA2B38C802F2AEF5B6BE2F8BAB469CC7A5CE2DD6607C68CF4D38
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:[easepxe]..BaseDirectory=C:\Program Files\EaseUS\Todo Backup\bin\..TftpPort=69..Hide=0..WinSize=0..Negociate=1..PXECompatibility=0..DirText=0..ShowProgressBar=1..Timeout=1..MaxRetransmit=6..SecurityLevel=1..UnixStrings=1..Beep=0..VirtualRoot=0..MD5=0..LouserP=..Services=111..TftpLogFile=..SaveSyslogFile=..PipeSyslogMsg=0..LowestUDPPort=0..HighestUDPPort=0..MulticastPort=0..MulticastAddress=..PersistantLeases=1..DHCP Ping=0..DHCP LouserP=..Max Simultaneous Transfers=100..UseEventLog=0..Console Password=tftpd32..Support for port Option=0..Ignore ack for last TFTP packet=0..Is Proxy Dhcp=1..[DHCP]..IP_Pool=824207444..PoolSize=0..BootFile=easeus.bin..DNS=1953719669..Mask=1902465594..Gateway=543649385..DomainName=..Lease (minutes)=0..AddOptionNumber1=9959792..AddOptionValue1=<..|A..|4..AddOptionNumber2=2090138457..AddOptionValue2=\..|......AddOptionNumber3=0..AddOptionValue3=h....AddOptionNumber4=9960128..AddOptionValue4=.p..............AddOptionNumber5=4..AddOptionValue5=H.................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5N3SR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):161288
                                                                                                                                                                                                                                  Entropy (8bit):6.234448381208898
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:289BC447D00FF31CEF63CAF427203BDC
                                                                                                                                                                                                                                  SHA1:43593EF6CCE6B3CDE7911EF47E8B85423C4D1169
                                                                                                                                                                                                                                  SHA-256:50CFFC446510D2736DA47BCFA21A3CE1E67EB9158AD6688D700760B4456B9965
                                                                                                                                                                                                                                  SHA-512:D4CA7BC067FE7977F8F3399E2894169F8214243B0E6B154D72BFFFF9B4E2A242C31E27080DE52C6D13A137F5421BD3877643D77561E534E51502C4D861CADEF4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tI..'I..'I..'...'H..'@..'K..'@..'G..'@..'@..'@..'@..'I..'...'@..'A..'@..'H..'W..'H..'@..'H..'RichI..'........................PE..L......e...........!................................................................k....@.........................@:..f....0..d....P...............L...*...`..........................................@...............\............................text.../........................... ..`.rdata...Z.......\..................@..@.data...X....@.......&..............@....rsrc........P.......,..............@..@.reloc..x....`.......4..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5NFI8.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):77320
                                                                                                                                                                                                                                  Entropy (8bit):6.679675751572021
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:47375D924375CECB774BD05376795B35
                                                                                                                                                                                                                                  SHA1:310F5D2DEBE21C8031006BA760E3C455D065B7F8
                                                                                                                                                                                                                                  SHA-256:9F5B9FBB0AE1BADFD0101922EF8BABB0E866FF5D17A34ED35FE5F3F7F95C1C4B
                                                                                                                                                                                                                                  SHA-512:A2DC7D20B6C33AE91E884BBF14094E4F8C61D984E340A36A2328DCF83B05FC4E2A9593F0BBE6DFC5F61E40A5C78CA1DACD98C3885DA7294EC2E72206D40941DF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B7..#Y,.#Y,.#Y,.l.,.#Y,.[.,.#Y,.[.,.#Y,.[.,.#Y,.[.,.#Y,.#X,.#Y,.[.,.#Y,.[.,.#Y,.[.,.#Y,Rich.#Y,........................PE..L......e...........!.........@......e........................................0............@.........................@...........P........................*... ..........................................@...............t............................text............................... ..`.rdata...'.......(..................@..@.data...............................@....rsrc...............................@..@.reloc..>.... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-5T2DR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):974848
                                                                                                                                                                                                                                  Entropy (8bit):6.5851603551162965
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:69C397CF479ABE6230E237C7B3038D27
                                                                                                                                                                                                                                  SHA1:7F0A90EFE55D6561342A784CBBB706829F2F3B39
                                                                                                                                                                                                                                  SHA-256:8F48BCE06E8F23DF42120E3FE000F9CAB3B3DDD89C492ACA4D01AEDEE5BC64AA
                                                                                                                                                                                                                                  SHA-512:C3532E99E2EE087812F973B4063575B5AD48AE30FFCEA5BF662DFA7FEE1708FD778FCD169BE2757B330FE8357D378CB54A869C8A4C99B53A43B57DB67E34431E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...h.}.h.}.h.}.a...|.}.:.|.l.}.:.x...}.:.y.b.}.:.~.o.}..|.l.}...|.y.}.h.|.R.}..x.C.}..}.i.}....i.}....i.}.Richh.}.........PE..L..."~@`...........!.....l...v......&........................................ ............@......................... ...T...t........`.......................p......@...T...................8...........@...............$............................text....j.......l.................. ..`.rdata..............p..............@..@.data....J.......F..................@....rsrc........`.......<..............@..@.reloc.......p.......>..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6CE3K.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):166920
                                                                                                                                                                                                                                  Entropy (8bit):5.965390845695746
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:800C208319C01258F6102677DD5C5231
                                                                                                                                                                                                                                  SHA1:5DBE9BF0A4149D9DC30816987EF8E43C0D77D9EE
                                                                                                                                                                                                                                  SHA-256:8F1694D64A65A76AAF57E76C70F8F252FB97220C1248F73133E56398F0199431
                                                                                                                                                                                                                                  SHA-512:EE3EE128DB5CC6097CCFDDA11F149FD0D3AC405974AB0C66294589544883035058E7A81CCF8A459C8577FA4B7BF5A810284FA3A9AD128E106E523C9B74CCA005
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...`...`...`$.U`...`..V`...`..@`...`..P`...`...`T..`..G`...`..W`...`..R`...`Rich...`........PE..L......e.....................r....................@.................................#9....@............................................8............b...*......T....................................|..@...............X............................text............................... ..`.rdata..T...........................@..@.data...8...........................@....rsrc...8...........................@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6HDEG.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):6230
                                                                                                                                                                                                                                  Entropy (8bit):4.099209331890979
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A0F4426B03D0D8511DF37FC5134A6163
                                                                                                                                                                                                                                  SHA1:834DEE2A6A914EE884B452454C0C4CE91189B7D0
                                                                                                                                                                                                                                  SHA-256:6F7424B184DA92124D17E1C39ECA6EDEADA7D0CF517BB386336087A1CE014963
                                                                                                                                                                                                                                  SHA-512:51798FE841A21D09EBF7AD873E1BE33F5868DB60987C69D67ABA65FA9904F1AF4953F8643E404D0A6CD6BD9CFC40629F0E2A7B84D63D6AB7CFD8710D3A388B4A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:{.. "name": "Qt built-in GPU driver blacklist",.. "version": "5.15.2",.. "entries": [.. {.. "id": 1,.. "description": "Desktop OpenGL is unreliable on some Intel HD laptops (QTBUG-43263)",.. "vendor_id": "0x8086",.. "device_id": [ "0x0A16" ],.. "os": {.. "type": "win".. },.. "driver_version": {.. "op": "<=",.. "value": "10.18.10.3277".. },.. "features": [.. "disable_desktopgl".. ].. },.. {.. "id": 2,.. "description": "Intel Q965/Q963 - GMA 3000 has insufficient support of opengl and directx",.. "vendor_id": "0x8086",.. "device_id": [ "0x2992" ],.. "os": {.. "type": "win".. },.. "features": [.. "disable_desktopgl",.. "disable_angle".. ].. },.. {..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6L87R.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):401462
                                                                                                                                                                                                                                  Entropy (8bit):6.399163134171948
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CB21D826D9C39AED19DD431C1880F5DE
                                                                                                                                                                                                                                  SHA1:6EAFCC2FDFDF73ABEA334AC7AFB903829F6FF2A6
                                                                                                                                                                                                                                  SHA-256:F1FD0F1A54F196B19A6F21044092C89C02353DAD173C236D80F6474CB8A7EA7F
                                                                                                                                                                                                                                  SHA-512:D4223A0AD6118B1DAE8505AD4675F6E87E4FA9EBCA6FDBE2EE3F0EA868CED15F07FB5AE2D9A41D8992A9D41A9BBE4B16F7AC6EEB1C99324ED8FA3A8FC47AF150
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.T....................2...............................................Rich....................PE..L... ..9...........!.........`.....................x.................................................................8..D`......V................................,......T...............................................d............................text................ .............. ..`.rdata..0...........................@..@.data............ ..................@....rsrc...............................@..@.reloc...,.......0..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6O9EV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.115758526998131
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E7E679DFD5704FB3BBAE35B1675F66D9
                                                                                                                                                                                                                                  SHA1:2C0CC9796DD06A69B6C0E0DC4A75A93AEB294B92
                                                                                                                                                                                                                                  SHA-256:057B0483FEE48563E78FF5A4CE27DB03B65189D8A9CB16B4E0D9CCDEAB769C81
                                                                                                                                                                                                                                  SHA-512:5393964B1DD842FE6BE7346A57ECEA8CD7460F5FA4596137B1A2B6DDF71DDCFF5E6584F3199D0AAD3B3C3C234D4CDB7A4C63A2E7954FD30B7B02F415EDD64855
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........B...8...8.......^*oX........d...|...|...RSDS`.8.R).A......V....api-ms-win-core-processthreads-l1-1-1.pdb...........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........oX........................@...x...........L...............7...k...................c...............0...q...........&...Q...................R...}...............................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstructionCache.kernel32.FlushInstru

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6RRCF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.129612333349008
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:53D8E61BA651A14E136C3AC3D30DFB35
                                                                                                                                                                                                                                  SHA1:A470DBD794D0A3A23D01F13D146E8CEF8DEC6886
                                                                                                                                                                                                                                  SHA-256:37489D3F078513ECCCB7BFB9F18EC1338D011B91AD091085AD1DB02F633A23BF
                                                                                                                                                                                                                                  SHA-512:2BE10659F627BF456D0E75BFE58F2306141841E6EE2D38A742C2E9F4282122075DE42A882639643FDA9957026EFCB0E6DFC00995C911515FAE94690923A9BFC8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......n.....@.............................e............ ...................<..............8............................................................................text...E........................... ..`.rsrc........ ......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDS.Gt.^..E......."....api-ms-win-crt-locale-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................X...........8...n...............Q...w...................D...d.......................2......."...W...............C...h...................;...V...{...................(...........................................api-ms-win-crt-locale-l1

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-6TOS7.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):105992
                                                                                                                                                                                                                                  Entropy (8bit):6.3379885919884575
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:499E61DB860266692972A1619DFD7654
                                                                                                                                                                                                                                  SHA1:BF2D90D4CD60605996713E70BDCEF0563C9C346D
                                                                                                                                                                                                                                  SHA-256:9DAC27F9A3E292C2DDD4524E7E2EEF8295D6D78DFF6137092E2A97472FD0FEC4
                                                                                                                                                                                                                                  SHA-512:63A4A5F1C5F4F805D3609AAA7DD43EFB7CEF6969CFAC0003BADCBF2AC68D85DAF6C59F8EC5434D97EDBB0389CFFF688EE1E00F68D34859A19CFEA3EEF8648BE3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O........................................................ ...........................Rich............PE..L...K..e...........!......................................................................@..........................g.......T.......................t...*..........@................................G..@............................................text............................... ..`.rdata...h.......j..................@..@.data...t....p.......Z..............@....rsrc................^..............@..@.reloc..d............b..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-70AL7.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):132104
                                                                                                                                                                                                                                  Entropy (8bit):6.380013473387245
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:86B61F835392365A59DB5E008D22A589
                                                                                                                                                                                                                                  SHA1:2F9E3036A91830BFB008DA9640F050EB81FCE923
                                                                                                                                                                                                                                  SHA-256:1AF7BC16664AD830B0B657285ED844AF1630579C6B61651075C1E3CB579B10EA
                                                                                                                                                                                                                                  SHA-512:653F5165CC1EB1ECB8B4ABBB85EB73D97A4C9C67CEE731D4224C9F81178B93CD0746AC765B6B60A3A72A127573EC1E2C78A6CB8BB1DDBB00D14A755D3CB44189
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................-...............8.......?.......(.........q.....1.......).......*.....Rich............................PE..L...s..e...........!.....T...........Q.......p...............................P......C.....@......................................... ...................*...0......ps..................................@............p..4............................text....S.......T.................. ..`.rdata..jb...p...d...X..............@..@.data...d9..........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-70GJM.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):28168
                                                                                                                                                                                                                                  Entropy (8bit):6.796679069799109
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3BE3E1E524C8A2A25C852DB2BE03899D
                                                                                                                                                                                                                                  SHA1:D29732B83253B86C72D8106D63229E31A0BD1D5F
                                                                                                                                                                                                                                  SHA-256:CE53718DED09B262274AF5D5FDBDA3C1F833AB27ACBA2F3E9D9DDD74F072E4EE
                                                                                                                                                                                                                                  SHA-512:20EE62A66F3F2F43B7BCABCA61F4958DE2AB97AA4A99D09DCDCB47EFA7C375BB1B02035071D5BD0BF6AF6DECFCD285A8B0191300CFD720DBC1E8520891A481BC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............Z.Z.ZT..Z.Z...Z.Z...Z.Z...Z.Z...Z.Z.Z..Z...Z.Z...Z.Z...Z.ZRich.Z................PE..L......e...........!....."...........+.......@............................................@..........................P..i....K..P....p...............D...*...........A..............................8F..@............@...............................text.... .......".................. ..`.rdata..)....@.......&..............@..@.data........`.......8..............@....rsrc........p.......:..............@..@.reloc...............>..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-71J6G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):26120
                                                                                                                                                                                                                                  Entropy (8bit):6.938016408606225
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:08C97C839BDF19222ECEA2618D0D92A6
                                                                                                                                                                                                                                  SHA1:0D8308C5AE2777D4D343827C61DC5D87FA3E84BA
                                                                                                                                                                                                                                  SHA-256:5AE3368B359FAC980BDA959995801A24F5CCD71DB0F96F914407B11695FB8661
                                                                                                                                                                                                                                  SHA-512:E6522D35405F4A7268BF7962316D7A8195C4624909A08E9FC92EC5DC5E1B1CB32D1DC02A9C4FCD056497FF8B252D1123B6A1E8E6F7B94FB753DC0F044184EB2E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........GS..&=..&=..&=.Ti...&=..^...&=..^...&=..^...&=..^...&=..&<..&=..^...&=..^...&=..^...&=.Rich.&=.................PE..L...F..e...........!..... ...........(.......0...............................p......+A....@..........................;..h...D6..<....P...............<...*...`..<....1..............................x2..@............0...............................text...[........ .................. ..`.rdata.......0.......$..............@..@.data........@.......0..............@....rsrc........P.......2..............@..@.reloc..,....`.......6..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-725FO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):59392
                                                                                                                                                                                                                                  Entropy (8bit):4.4116556724624365
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9BFF4F740C98EA1D881D94512B08013C
                                                                                                                                                                                                                                  SHA1:D8850F329ED0DE8EBEFC1CC77CC0621C31EF488B
                                                                                                                                                                                                                                  SHA-256:6AF004041FDFC158616DCC40A26853AC82F0D70F03FB4EED2E15FFFAB01551CF
                                                                                                                                                                                                                                  SHA-512:4641361CE0FB9A33C10C6C4D9FE447FFF925693357C129D2A643A3589E1A8F43ED3DBF55ED0EC685BBE634DEB9C86E8E03762C2AD21669DB13D763864C946E31
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]......................................@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-79K96.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):38920
                                                                                                                                                                                                                                  Entropy (8bit):6.756535655776062
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E88908FC8A4D5F11CDABFAD8D186DFA1
                                                                                                                                                                                                                                  SHA1:28B8ADC625C720CE759C8B5C55374DB2144DF9DD
                                                                                                                                                                                                                                  SHA-256:9C673DE77F573E2AFD570EE78EEE82B1DDC6B454E6078F22C2A9F9459603237C
                                                                                                                                                                                                                                  SHA-512:F1569D011FD9EF6942C222672420A829664A8394B48F92E381E9C731E599729F1F6DE8B2DC5E427694AE99CB7880653D1713C7B132639B78343E91A14CD664F8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jr^............QD.......s.......s.......s.......s...............s.......s.......s......Rich............PE..L......e...........!.....D...&.......K.......`............................................@..........................x..m....m..x....................n...*......(...Pa...............................c..@............`..4............................text....C.......D.................. ..`.rdata..]....`.......H..............@..@.data...(............b..............@....rsrc................d..............@..@.reloc...............h..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7BG7D.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):59400
                                                                                                                                                                                                                                  Entropy (8bit):6.521526084701271
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A4478A619DC3684EC32EE87811415697
                                                                                                                                                                                                                                  SHA1:A8387970B72EDF3E317EFE1943DAE5144292C115
                                                                                                                                                                                                                                  SHA-256:17193D652661DDF54B885BFC66BB8B8E22B389717579DBAB53140721D53D6650
                                                                                                                                                                                                                                  SHA-512:E00E95EAAACEB04CA9E8C584C3BB9729521346478B81A75FAFC80B1D7118B78DFFB2801B5332B0D4089D554FBD6561211D2BC9B42AAEF7AFBC1DF6008FD3EA61
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|^..0...0...0..R....0..e....0..e....0..e....0..e....0...1...0..e....0..e....0..e....0.Rich..0.........................PE..L......e...........!.....v...D.......{...............................................J....@.........................0...g...P...P........................*..........P...................................@...............(............................text....u.......v.................. ..`.rdata...2.......4...z..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7C2SF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):419848
                                                                                                                                                                                                                                  Entropy (8bit):6.3116797958278115
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B5948771B94DC0D744A329D9D14420C0
                                                                                                                                                                                                                                  SHA1:F96B94A9E0A0F146A59E247E3D02109376AB1D02
                                                                                                                                                                                                                                  SHA-256:C6C5FF07538BE6AA485E247DBE057BB94F8C884BBE7F2091A847EE99DCCDA018
                                                                                                                                                                                                                                  SHA-512:4FC103E92029F2CE4EBB370633C56AAE67584D083AA2D3BAFB4BCF1AB8DD69DCF94AA1B755CA8188BF84E0106CE5EBB8E3988BB22EA5287BD4D7A625D1543153
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z...;e..;e..;e..t...;e..C...;e..C...;e..C...;e..C...;e..;d.5;e..C...;e..C...;e..C...;e.Rich.;e.........PE..L......e...........!.........b...............................................p...........@.................................d...x....0...............>...*...@...#..p...............................p...@...............L............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc........0......................@..@.reloc..F-...@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7IDJ7.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):99848
                                                                                                                                                                                                                                  Entropy (8bit):6.729540065618133
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0457C18BEDED9071E6C0D47D156B16AA
                                                                                                                                                                                                                                  SHA1:487AAE20748425DB50BA78F2ED8FBB120EA361B3
                                                                                                                                                                                                                                  SHA-256:66555A00B12C94F26E97CF60606FB1183310C657BF4F46111AFF39F20D907AF4
                                                                                                                                                                                                                                  SHA-512:7610621301E1B7E021BCB9E534211E07865CEC313F80DE88B421E420370E47EAABF52A6D525BAE37DF34EA0D75EF6A500B5FC503651CE0188D0E97878871E61E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kK../*../*../*..e_.,*..&R\.)*..&RJ. *..&RM.**..&RZ.&*../*..*..&RC.)*..&R[..*..&RX..*..Rich/*..........PE..L...A..e...........!................#...............................................o.....@.........................P.......L...d....p...............\...*..........................................h...@...............\............................text............................... ..`.rdata...O.......P..................@..@.data....T.......L..................@....rsrc........p.......J..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7ITIA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):17600
                                                                                                                                                                                                                                  Entropy (8bit):7.194251768909352
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3956225336012716E0E99541B5FF76F7
                                                                                                                                                                                                                                  SHA1:0127F03A4D71D74C9B3F1758CADCC620638B56EB
                                                                                                                                                                                                                                  SHA-256:BEF15C4F182503B9F9DC582552E47C01EFB2B6B6BF02B7EEECABFF49724F93B1
                                                                                                                                                                                                                                  SHA-512:CF9B7803F92EC345978B5E1EDAE05F0ABDE419D172A5246D77551CF8D546C22FD87D5A64E3F911EA877BE9190916264322CBD35EDDCE0D873AA53A3C4E6282AE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0...........@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........;...8...8.......^*oX........d...t...t...RSDSf@...^.E..L.=.......api-ms-win-core-profile-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX................................W.......?...x.......api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7KBC7.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):19136
                                                                                                                                                                                                                                  Entropy (8bit):7.078608375386252
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:539EDF31A28B27491FB6422F9BA24748
                                                                                                                                                                                                                                  SHA1:BBB0F9B93BFAC0C5CEA62F338D9F238A630EC1E4
                                                                                                                                                                                                                                  SHA-256:3103333EB85CAB4F9473D576680EB2AB2E60F6130EBCB7371BB308179C23DDB7
                                                                                                                                                                                                                                  SHA-512:0363FC4FB8CA1DD768E8412415B6A473BFBF9B61673EFDD5C92C349DDBEDF68B60A44D6E83A10ED8F7485E2DB6B36B9EE76DE6D18E06442BF78E9C5EE4E02329
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......O+....@.............................x............ ...................<..............8............................................................................text...X........................... ..`.rsrc........ ......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS..p...DO..D.F.......api-ms-win-crt-process-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02..................oX....p.......$...$...........(...........................)...A...Z...t.........................../...J...f...........................&...A...]...y.......................&...D..........................."...9...R...k...........................&...A...\...y...

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7KOJF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):734728
                                                                                                                                                                                                                                  Entropy (8bit):6.646499456960238
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D9971FC4E1FC10B2AF97F900656A1D9F
                                                                                                                                                                                                                                  SHA1:8AD1B5E3F0562428F6D2B47665BC66747F624B66
                                                                                                                                                                                                                                  SHA-256:074D5355D18B2A9212CA2A588C21DE7A851B7D89AB7F48B1280E27A4D6F2C731
                                                                                                                                                                                                                                  SHA-512:0897739328000AA59C97F6600524EB26BD8F999F0BAEA6EE2B399C0D8B754AA4216AA0A2F74B531001C1A44A880A4C71D26D7786A2682B8B9C727DEA41704715
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.G^V..^V..^V......\V..W...TV..W...OV..^V...V..W...FV..W...UV..W....V..W..._V..W..._V..Rich^V..................PE..L......e...........!.....0..........i........@...............................0.......W....@.............................................................*......(,..PB..............................0P..@............@..4............................text............0.................. ..`.rdata..}o...@...p...4..............@..@.data....,.......(..................@....rsrc...............................@..@.reloc...;.......<..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7LGK0.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.095060486452005
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A72A90D395DBCCEB4BE96938F01E5A96
                                                                                                                                                                                                                                  SHA1:D1ABB7BBCED6A8F7AE469FED37FD572DB6B7DC93
                                                                                                                                                                                                                                  SHA-256:D6F87EF0D75B45F58A9E6693E38D8C77A6F5FBC7793ED19954661DF5F76B90C9
                                                                                                                                                                                                                                  SHA-512:A5EB03E436D90BAF5F423109CE9A6CBC7C8870211F0B4D20B50F84BE8471DF9A55CC9C79DE3CCD8F119586C53A60BB93A74CDCE73D5D75379EBC3C7B03F25073
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......3....@.............................l............ ...................<..............8............................................................................text...L........................... ..`.rsrc........ ......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS....R.PE..EhC"......api-ms-win-core-memory-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................H...............0...W...................#...G...j...................0..........."...G...p...................;...\.......................................................api-ms-win-core-memory-l1-1-0.dll.CreateFileMappingW.kernel32.Cr

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7N5IM.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):147456
                                                                                                                                                                                                                                  Entropy (8bit):6.119753222814201
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FD306A29934D84ED646E71661F25F4F5
                                                                                                                                                                                                                                  SHA1:E75F51B1738B272AB6D3280501EA68784E99A320
                                                                                                                                                                                                                                  SHA-256:6D4C96D9E2470D814450E196A5788366A99B6F341716C0D06169A9408F395E27
                                                                                                                                                                                                                                  SHA-512:A882F5FB547C03725B3A98A001DD68EC2DF971255D3BAE7116B0D9FAEE010C36C6D656A8C30B3FB05E7B4EF0F180B47905AA767C97D13CE554C415E076EBC7EF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./I7.k(Y.k(Y.k(Y..7].i(Y..4U.j(Y..7J.a(Y..7R.i(Y..4W.h(Y..7S.o(Y..7].o(Y...R.i(Y.k(X..(Y...].h(Y.m.R.}(Y..._.j(Y...].j(Y.Richk(Y.................PE..L...W..H...........!................w........................................`..............................................h........@..8....................P..H.......................................................|............................text............................... ..`.rdata..>O.......P..................@..@.data...(.... ....... ..............@....rsrc...8....@....... ..............@..@.reloc.......P.......0..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-7SVLL.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):580096
                                                                                                                                                                                                                                  Entropy (8bit):5.847233681314949
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C8EBECFDD9C8E2EB97D232FC0CE5A52F
                                                                                                                                                                                                                                  SHA1:601837F78F5B2691BC7DBC3F37918044E58E12A6
                                                                                                                                                                                                                                  SHA-256:9B15E4A5B2A63004F6839D55F169755D9BABE76FEB456B7F9A3128513595D3AF
                                                                                                                                                                                                                                  SHA-512:77E4DCE9F6687C75FCFDA483543937B3B638BCCC3508AA94E9344874F6E9ECC5D0E61FF51A8BB29E2C3306D73C9E7D11C8B9C31EF6ADC542FDA91C116DCDC739
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u......................l=......l,......l;..............l+......l:......F<......l9.....Rich....................PE..L.....]e...........!.....\...z......xP.......p......................................y....................................Q...`..P.......D.......................0B.. u.................................@............j...............................text....[.......\.................. ..`.rdata..8....p.......`..............@..@.data....<... ...:..................@....idata...F...`...H...>..............@....rsrc...D...........................@..@.reloc...J.......L..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-82JCC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):180224
                                                                                                                                                                                                                                  Entropy (8bit):6.464956241249125
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C0BC9B2E0629154B5B66BAC7A5F7C6C6
                                                                                                                                                                                                                                  SHA1:C7E1DC50018D9FEE541F16642361F0CADBC85EC5
                                                                                                                                                                                                                                  SHA-256:93115889C0FB5BEEA1A1EE29A64189C84AD3BB5B5BCC51F401888468C55F3150
                                                                                                                                                                                                                                  SHA-512:E00692DC2CE3665D00D5078C92B7FEA65999120649F3D6830296DA114D3F316C451B91A929DE95963DD550A50DDDB80A67876B200FEEC5D25DE9C63FE35758C8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................\..................................(........@..(.....(.....(.0....(.....Rich...........................PE..L...-.@`...........!.........&.......w....................................................@..............................=..LG......................................P...T...............................@...............<............................text............................... ..`.rdata..v...........................@..@.data...D*.......(...x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-89GIS.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):23048
                                                                                                                                                                                                                                  Entropy (8bit):6.985316352315291
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C9CC043A793DFFF324221DF6F4E791EE
                                                                                                                                                                                                                                  SHA1:ECEFF62EBB01626587A7BF6A8DEEF533EC1BED7C
                                                                                                                                                                                                                                  SHA-256:412E8DB7AA2DDEE190F8F922E7CB6427E3EF99E2C83DF4F21DBE804F054BF64D
                                                                                                                                                                                                                                  SHA-512:02FB085229868E061748105C0BC297434E384FCF9493D5C8E571273ED1D32CB5EFA72B24D10E22694A571AAAD70963D849677A25ADFD0573DDA305586EDD8537
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.c.6.0.6.0.6.0~yV0.6.0.NU0.6.0.NC0.6.0.ND0.6.0.NS0.6.0.6.0.6.0.NJ0.6.0.NR0.6.0.NQ0.6.0Rich.6.0........PE..L...|..e...........!................Q".......0...............................p.......!....@..........................7......L3..<....P...............0...*...`.......0...............................1..@............0...............................text...X........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..&....`.......,..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8A8JE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):168456
                                                                                                                                                                                                                                  Entropy (8bit):6.355459633543466
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EEBDAAE956AB39A9B8D656009DF99E09
                                                                                                                                                                                                                                  SHA1:A4DEBEE232338C66877F92E3948D4973DACE12AA
                                                                                                                                                                                                                                  SHA-256:99A97C3A07B1F1F2631DAE68CF72F2EF6E1B75D6C740FAF431741D2B5D2CC26C
                                                                                                                                                                                                                                  SHA-512:8D0070939F3A1E57C83ACC1D05D49A26A48E1F1DB8094F47B4303221C5F75D9F424436CF32B4A16BAF84EC4E5BD0459B657F72E1F5E04C98C48E2B54CCDB82AA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.............n.......................................s........................Rich....................PE..L......e...........!.................................................................M....@..........................S..{....9.......p...............h...*..............................................@...............\............................text............................... ..`.rdata..............................@..@.data...$....`.......F..............@....rsrc........p.......J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8CIIF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):169480
                                                                                                                                                                                                                                  Entropy (8bit):6.456493596865502
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5CDB0C237A86A0FBC3CF553911BEA7A3
                                                                                                                                                                                                                                  SHA1:7E79D7EB6D74FE5263703505B321E08B3C66F537
                                                                                                                                                                                                                                  SHA-256:C552F20A39AFFD55868A15416A223BD658A6A9F5E6CDF1B8B12BD635DFD9B699
                                                                                                                                                                                                                                  SHA-512:329509CB419BD417B5FBBD1862907F749AE5E28286F1925198199B90D3E29124EEF09495AB4624C6883EAB13F360011778F63060B9C56F1F70426DF914CE4D28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}..............S.......d.......d.......d.......?.......d...............d.......d.......d......Rich....................PE..L...S..e...........!.....|...........v..............................................z.....@.............................N............................l...*......$... ...................................@............................................text....z.......|.................. ..`.rdata..............................@..@.data...@U... ...D..................@....rsrc................H..............@..@.reloc..D........ ...L..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8DHNS.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):144392
                                                                                                                                                                                                                                  Entropy (8bit):6.337114960135654
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7950A24C84A8800EE3B4B77461354B02
                                                                                                                                                                                                                                  SHA1:D5AC88B23E2C124660B9952BC78CE694A2F80729
                                                                                                                                                                                                                                  SHA-256:3223BB792ECC4B00DE8FB168DEF2B0F66D5BFD3F49A19C530323EF6295F8716F
                                                                                                                                                                                                                                  SHA-512:48235AB9379D460EB795A63D5D204C0FA99903E70AA8B1A2D78D2A456090925D53FB9E11B14520D65D605B29EF62C841890A2AA8EE8CB4263722B9E475457EC6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........}...}...}...2+..}....(..}....>..}....9..}.......}...}...}....7..}..../..}....,..}..Rich.}..................PE..L......e...........!.........r...............................................P............@.........................0...J.......P.... ...................*...0..........................................@............................................text............................... ..`.rdata..zX.......Z..................@..@.data...4...........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8EI4U.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):67592
                                                                                                                                                                                                                                  Entropy (8bit):6.531932380559342
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CA6BEC56C7AD2E14EEC0CC947C111069
                                                                                                                                                                                                                                  SHA1:7BC35B80E049427225D0E34084958BB3D490C394
                                                                                                                                                                                                                                  SHA-256:40173B01C6CF8B977E2A1EEBAE95A7547880CF7B1DA17792692EE003FCC8C9DF
                                                                                                                                                                                                                                  SHA-512:BC0B7C400B0C39E11E16282331274DBB3CC0E09139A1611ADAD58D9833AC373531C32D092DA8C9FDA1C596CBE5EDE40B326BA37B2256D86F529844E80DF131C0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:J.u~+.&~+.&~+.&.d6&|+.&wS5&x+.&wS#&p+.&wS$&{+.&wS3&y+.&~+.&B+.&wS*&q+.&wS2&.+.&wS1&.+.&Rich~+.&........................PE..L......e...........!.....n...l.......o....................................... ............@............................V.......P........................*..............................................@............................................text....l.......n.................. ..`.rdata..&*.......,...r..............@..@.data....0.......(..................@....rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-8EL2E.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):64520
                                                                                                                                                                                                                                  Entropy (8bit):6.575575653952775
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:06DB9A3F4333B50A3470F7BE6B95A6C8
                                                                                                                                                                                                                                  SHA1:7D671135B45868134FC448BDE90E1D9E53651C07
                                                                                                                                                                                                                                  SHA-256:E4D0D2D6D01AED73BD6827BDD77C2C7DF314CDB80BFD35EC5C1393DD8BBB14BB
                                                                                                                                                                                                                                  SHA-512:5EA1B9DCFD4A0FD8A997935C88C659AA018F5A2664BC60D2B42D256CCA274B30F3E3C43623C322801D86FAD1948FF279320BC0EC92C33A0D3BC005809BC5318E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............q...q...q.|.....q......q......q......q......q...p..q......q......q.Rich..q.................PE..L......e.....................F......4.............@.......................................@.....................................d........................*..............................................@............................................text............................... ..`.rdata..(4.......6..................@..@.data...@...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-91N14.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.130977907670735
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EAD03B9A61A23FF6275CA364A1C6536F
                                                                                                                                                                                                                                  SHA1:4221BE864A141079699E80B6B121BEB08D20C3C0
                                                                                                                                                                                                                                  SHA-256:DD0D05FEADF990EAA82D691BE1990A2BD2EBE7F9874880D1871760DC15D9B3C1
                                                                                                                                                                                                                                  SHA-512:E8B238BFF471D06439E170E90AF93251818F434CA56491494EE2D9684A1837825F2B169F9DC73201C5563DC7500C2438A6081DE56DD1A0B0CAB25C9382D6BFC5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!......................... ...............................0............@.............................^............ ...................<..............8............................................................................text...>........................... ..`.rsrc........ ......................@..@.....0oX........:...8...8........0oX........d...t...t...RSDSI.R...O..T..f.V....api-ms-win-crt-utility-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02..................oX....4...........................]...~...................%...<...U...r...............................+...B...W...p.................................../...V...m.......................5...L...g...............................!...>...O...h.......................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-96GCD.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.123744060629644
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:53621AC7D53BAA4414992AD17E6257A0
                                                                                                                                                                                                                                  SHA1:02A9B5DA969B50BFD677FA333B1AA82E481ED10F
                                                                                                                                                                                                                                  SHA-256:B469DC90D8A5D9FE77DA16A508DBDED6D4EB71AA925E452B8D5B9A70BEAB0A68
                                                                                                                                                                                                                                  SHA-512:7E5C373FA2D9013315405C61A832E931B8E79058BCECE73B89096094998E2F77B23DBA22DB11DC0FAADCCD38C343EA8E8776D508C6EE23E4055CA2814D79259F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......y.....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........A...8...8.......^*oX........d...|...|...RSDS.X.. .&E..g/).......api-ms-win-core-libraryloader-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........oX........................P...........2...]...................9...f...................?...f..................."...K...x...............&...U...................0...W...~...............................................api-ms-win-core-libraryloader-l1-1-0.dll.Dis

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9FFJH.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):309256
                                                                                                                                                                                                                                  Entropy (8bit):6.300891757960107
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F5892BF84104933918080B69D7F0A9D1
                                                                                                                                                                                                                                  SHA1:8ADFB0E9AECC998EB7C0BA262DA5C2CA48D29F96
                                                                                                                                                                                                                                  SHA-256:05537F983B9A702752A3FAE066A46C0C279E45235DD01033FEA13D5C64665A06
                                                                                                                                                                                                                                  SHA-512:FDC965A42F53E89C0FB4CB956212043915F455F7FD8C37D081F3DE6E0A2F076973B27DAB2407490158AD91AF8855F59FD62F9800AFE3D16F410988E35AFF4E63
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................2...................................Rich............PE..L......e...........!.....@...J...............P.......................................2....@.............................h............`...................*...p...(..PT..............................x...@............P...............................text....?.......@.................. ..`.rdata..h....P.......D..............@..@.data...<_.......$..................@....rsrc........`......................@..@.reloc..8~...p......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9JUDT.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):568832
                                                                                                                                                                                                                                  Entropy (8bit):6.529348877830445
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6DE5C66E434A9C1729575763D891C6C2
                                                                                                                                                                                                                                  SHA1:A230E64E0A5830544A25890F70CE9C9296245945
                                                                                                                                                                                                                                  SHA-256:4F7ED27B532888CE72B96E52952073EAB2354160D1156924489054B7FA9B0B1A
                                                                                                                                                                                                                                  SHA-512:27EC83EE49B752A31A9469E17104ED039D74919A103B625A9250AC2D4D8B8601034D8B3E2FA87AADBAFBDB89B01C1152943E8F9A470293CC7D62C2EEFA389D2C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..qQ.qQ.qQ..*.qQ.#..qQ.qP..qQ..>..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.Rich.qQ.................PE..L....=1G...........!.....$...p......B........@....Hx................................`.....@.........................@C......d8..<....p...................$......D2...................................$..@............................................text...!#.......$.................. ..`.data...h&...@.......(..............@....rsrc........p.......B..............@..@.reloc...B.......D...F..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9N7VG.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):395784
                                                                                                                                                                                                                                  Entropy (8bit):6.231293417772046
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B83D7E3BE632C65A313C0F74098E0663
                                                                                                                                                                                                                                  SHA1:97FD31860FA10FD78E918E0838485B6C645878CD
                                                                                                                                                                                                                                  SHA-256:59D7BF5C8DD80FD5C127EA66257E571B321F0C1316BE5257ACD99D9DDA9E9C77
                                                                                                                                                                                                                                  SHA-512:F9ED7FC92389EFE78B9B6CBF6E88879A8E3E4EE2CE1C547695088A231E514DB5C71CD9EFD92C2EC34C4BABA837046426AF07A2DE85A1C0D9D33A59D1A5504D6A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0..t...t...t.....~.w...}.}.r...}.l.|...}.k.{...}.{.....t......}.b.o...}.z.u...}.y.u...Richt...........PE..L...V..e...........!.........V.......N.......................................0......DU....@.........................P...w....}..x........................*.......0.................................. *..@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...A.......B..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9NCMO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS executable (COM)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):196297
                                                                                                                                                                                                                                  Entropy (8bit):6.628772410971914
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:49B62A2C1B5DFEFF2C4310257C2C1F47
                                                                                                                                                                                                                                  SHA1:E17116EFEEF786960CA5A738FD20CE775573DD43
                                                                                                                                                                                                                                  SHA-256:6CA18AC89EF4483BCE8D55E285B4BF1F4D676BEE4E450051A38CB74114C7F996
                                                                                                                                                                                                                                  SHA-512:A346431E45857166CA0F1FE818438F1CF05C437EE5919B8F334F665B049D669BBF49942575F1389275A69E03C420EAA4925C057B280DFE2FF9A1E75CC00B9396
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.>.. 9.............................................................[..C........SjS../..f.>.................t..L.h. ....1..........1.A..r......1.1........f.GRU.f9.u...... ..f9.uJ.r;......$?t........h...1.`.2.as.`1..).aOu....w/.......r.w...1.....1............RVWU...]_^Z.....f`......`.. ...."......f1.f1.f..$...f.....$..".....1.V..|W..V.............f........ ....fa...h.......<.u....Missing helper...............................X....P....r0.>..U.u(.....Kj@.......'.f1.1..D..u.8T.u.f.D.E.t....................................................................................................................[......"....1.1...f.t<..t.1.f1.f@u......U....f.......D....\.f.D.f.D.....f`.B.J.fa.fP.[.b.f@.............fXf.>......u..1..........[...........S.......Q............u.9.t.... ... .r;.....1.1.......h=..... ...1.1....................Ku..+....p.. x..............-.....-....Ku..1.....f1.6..f...............N................................/BOOT/EASEUSLD.LST......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VFRI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):100360
                                                                                                                                                                                                                                  Entropy (8bit):6.519367543409106
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1D23371D952DABF52B5694FA870DEA81
                                                                                                                                                                                                                                  SHA1:DDB26CAF5A44B834E6FD8B08B60DCDB5718CFA46
                                                                                                                                                                                                                                  SHA-256:68C971EA2D3AEB8F2FEBA9CCEFD8D5F91946CDBA7B8A9575E459A9431A0923AB
                                                                                                                                                                                                                                  SHA-512:5CEF9BE7FF91211BB601F9A4AFC50B2D232DC8741306103B56802A998EE44D28E4767298BEC29B7659EE7FB9D1CEB32C4144DADFF444EE2F1964E43CFAF437F5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................................5...........................................Rich............................PE..L...x..e...........!.........b......F...............................................L.....@..........................F..w...4<.......`...............^...*...p...... ...............................8 ..@............................................text............................... ..`.rdata..W7.......8..................@..@.data........P.......4..............@....rsrc........`.......:..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VOFA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):60416
                                                                                                                                                                                                                                  Entropy (8bit):4.407565762607766
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:07F20E09C028F0E5469CA8EB782724DE
                                                                                                                                                                                                                                  SHA1:8F3BD4C2D6133AD3C3BC9C1ECD33EB4BB73E4BE4
                                                                                                                                                                                                                                  SHA-256:996E42DDBEBA26F92F33338CCC8E3B2FAC91D70DED4C311C7A64C6850A7B2F0E
                                                                                                                                                                                                                                  SHA-512:E2664CE3D90F5ADB4BD81722BC42D6AE450AAEDDC5F66356E5BF3E63206820655C1A83068B075B07E62F0D83F9E17F187F5397D3576A684F205B8F8B1A79697C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]......................................@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-9VROD.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):24584
                                                                                                                                                                                                                                  Entropy (8bit):6.875771678448983
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:580C462F66D953049BD0ED0978300F1D
                                                                                                                                                                                                                                  SHA1:B8E58B083D160E6688E675A5457DD490B5C31FBD
                                                                                                                                                                                                                                  SHA-256:7048BB5DFCA82DB2A474488593C91BE4A0762CABE864B072A26E4460BB374FC4
                                                                                                                                                                                                                                  SHA-512:5FF6568AD19A2DF9EE107A2F73A59B926888352D494DB639173E723FE8CF3449A7CBCEB4B2BEE916F9D6DD9B8AB7641A7FC958C2BCB43766397BCE99BE38A099
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................,............................................Rich...........................PE..L......e...........!................. .......0...............................p.......m....@......................... >..q...\8..P....P...............6...*...`..x....1..............................06..@............0...............................text...%........................... ..`.rdata.......0......................@..@.data........@.......,..............@....rsrc........P......................@..@.reloc.......`.......2..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A0VGE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):167944
                                                                                                                                                                                                                                  Entropy (8bit):6.692364198230331
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0C56328D1211D36B679F95D9BA11730C
                                                                                                                                                                                                                                  SHA1:59C3DA79443F42C80BE53C1B6BBB9E2044AD608E
                                                                                                                                                                                                                                  SHA-256:2950A610BE32B20BC7C6F459013E108D99161CBD3D20290941093E36DB2D535B
                                                                                                                                                                                                                                  SHA-512:D285AF579927BAB32F389386219240788F2C43E4DE83D569F043DE9CAAA023E678B4D77C27C15B0BD81511441C31778800ADBD41DC1B236A518A3177493855C3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|..............bRe......ef......ep......ew......e`.............ey......ea......eb.....Rich............PE..L...@..e...........!.....L...........J.......`......................................X.....@.....................................x....p...............f...*...........a...............................m..@............`..`............................text....J.......L.................. ..`.rdata...2...`...4...P..............@..@.data...L...........................@....rsrc........p.......N..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A1HFI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.1618903586459695
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4BCE918C3F34C152EA99591B7501C932
                                                                                                                                                                                                                                  SHA1:B83E00BDBC78AF04146E267A98BCCB1597902203
                                                                                                                                                                                                                                  SHA-256:ED8B2DEF856E4EFFCE4856EFCC7F3C35FB7E3428287BA8851CDE2DA8DF1D1C58
                                                                                                                                                                                                                                  SHA-512:463D73D57CA18C91E401B0293F78286D1D3221775F4A2EA3EE3E59137697BEDE9327F32B0335E4275626F1B31030543E6ABD48988A1F976EC1DD3CBC1B680A9C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......B>....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........7...8...8.......^*oX........d...p...p...RSDS>3..IE.I.'..h.......api-ms-win-crt-heap-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX........................t.......C...j...............3...f.......................6...Y...t.......................C...d.......................5...Z...................U.......................%...P...k.......................5...Z...w...........................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A2NEM.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):651272
                                                                                                                                                                                                                                  Entropy (8bit):6.089608545347448
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:11803F6B2728EE157DC1FC0A253EA3F7
                                                                                                                                                                                                                                  SHA1:C4027A4C5718EF785F1115130A326D6541B0E769
                                                                                                                                                                                                                                  SHA-256:3AF44524A92E88EB2A3D93713B96EE5E43310245E24AB726CB67215CE8EACDA6
                                                                                                                                                                                                                                  SHA-512:57AB4B7C12ACC93AB14871F9B9A758FAD74F8718C3B6CF3826C1A128D3E09DB9BD40C3E23F2101EF811F8513B2B1D23C35DAAC4203EA73115B2AD98B5FF0779D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.v.>..F>..F>..F...F<..F7..F6..F7..F$..F7..F1..F>..F...F7..F(..F7..F ..F7..F?..F ..F?..F7..F?..FRich>..F........PE..L......e...........!................`...............................................n.....@..........................l..f...PW..........@................*......D3..................................`...@............................................text...)........................... ..`.rdata..&m.......n..................@..@.data....!...p.......b..............@....rsrc...@............|..............@..@.reloc..BA.......B..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A8VQO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):21696
                                                                                                                                                                                                                                  Entropy (8bit):7.0046949398006415
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B5A9FAB8A1FE14F47F953FB58B648FC8
                                                                                                                                                                                                                                  SHA1:A374CBB6D4B1DCADFABC2C3F7E7183E0472212BE
                                                                                                                                                                                                                                  SHA-256:00613EFA358764930353232F3442EBB934506051CD7D4EEC545E2DA35AA8546C
                                                                                                                                                                                                                                  SHA-512:AFB668DE538C2478202D16C3E877A4107D46A03A102C2C5D692C87BDCF904E9763869A3E317CAC214D8E4140D65123C1F52928DB4C826DD4CBCC11BE86A40B99
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!.........................0...............................@......e.....@..........................................0...................<..............8............................................................................text............................... ..`.rsrc........0......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDS..|...pO...;.^......api-ms-win-core-file-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................oX............K...K.......4...`...&...P...{.................../...\...............1...t...............&...O...................+...U...................9...^...................T.......................W...................E...p...............=...o...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-A9M9F.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):59904
                                                                                                                                                                                                                                  Entropy (8bit):6.048382351359956
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:371226B8346F29011137C7AA9E93F2F6
                                                                                                                                                                                                                                  SHA1:485DE5A0CA0564C12EACC38D1B39F5EF5670A2E2
                                                                                                                                                                                                                                  SHA-256:5B08FE55E4BBF2FBFD405E2477E023137CFCEB4D115650A5668269C03300A8F8
                                                                                                                                                                                                                                  SHA-512:119A5E16E3A3F2FF0B5ACB6B5D5777997102A3CAE00D48C0F8921DF5818F5FBDA036974E23C6F77A6B9380C6A1065372E70F8D4E665DFD37E5F90EB27DB7420C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...Y`1G...........!.....:..........rG.......P.....x.........................0......Ko....@.................................|................................ .......R...............................T..@............P..,............R..H............text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...P...........................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AA45F.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):28440
                                                                                                                                                                                                                                  Entropy (8bit):6.836559711151476
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CB8E791FAF8A711F9863F759F37FD316
                                                                                                                                                                                                                                  SHA1:AB7A1A33574364D8BFBEACE46BDA3C8192FAF379
                                                                                                                                                                                                                                  SHA-256:F1EFC4A0F0AEF50477FC979642A51B1CDCD23C689F98AFA9F5A039F5F05904F0
                                                                                                                                                                                                                                  SHA-512:30A30FFCB3514649D2AA747D4036EEF50DBFD986D1BF8E5E855F74A5C55DB61C4D77444378EDDCB73A251CB22FE4F8658A0AA7989A78552B36A7FED5BFCC1A2C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........4XA......=.........................................Q..........Rich...........PE..L....(.[.........."!.........................0...............................p......m.....@A.........................)..J....@..x....P...............0...?...`..p...p...8...............................@............@...............................text...*........................... ..`.data...H....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc..p....`.......,..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ABGAJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):17600
                                                                                                                                                                                                                                  Entropy (8bit):7.2095181645303725
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:93782E5CEEC3E124D92286802903DBB2
                                                                                                                                                                                                                                  SHA1:A53A3E170F0A813CA7B78742B7008C39FF7A2BF2
                                                                                                                                                                                                                                  SHA-256:CC609900E84B3C3021FF54A587A442B5F0DB368D7853E687594D20997F1B7684
                                                                                                                                                                                                                                  SHA-512:EE33D33B94DDA7D9D4E6F93BC6C123A259DFB11724981023A98D56B583F47EBEE3D3E4D26AAFCC75FDE80AEF54C82DFD5396E37E5E6F03B9CC32344A2FA81B7B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDSA...^.O.m.0..6.....api-ms-win-core-debug-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX....0.......................(...\...............Q...p...................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStringA.OutputDebugStringW.kernel32.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ACCV7.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):22208
                                                                                                                                                                                                                                  Entropy (8bit):6.92654574139827
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5760BEC3A8C82192D724254B80997B83
                                                                                                                                                                                                                                  SHA1:9638CBE7C220DD8ED432104C20FB9DBFFBF3E35C
                                                                                                                                                                                                                                  SHA-256:BA51A438D47331DEEF6178345B235E768A4E648D43FD44E28B95E7292CD4F04C
                                                                                                                                                                                                                                  SHA-512:56892E8B9D1E34210821B41DEFAA60E9D1D0014CF827A0AB358BFDEA29E95DD5D82565ECD8D81AAEF2B93F2B30AEF7B1898691ADC0660278E5C9047DA33FF070
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!.........................0...............................@......*.....@..........................................0...................<..............8............................................................................text............................... ..`.rsrc........0......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS*.....A..>....R....api-ms-win-crt-convert-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02..................oX............z...z...........................I...b...}...........................;...S...j...............................0...I...`...w..........................."...?...^...........................>...^...........................*...C...\...x...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ALNIR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):449280
                                                                                                                                                                                                                                  Entropy (8bit):6.670243582402913
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1FB93933FD087215A3C7B0800E6BB703
                                                                                                                                                                                                                                  SHA1:A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
                                                                                                                                                                                                                                  SHA-256:2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
                                                                                                                                                                                                                                  SHA-512:79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AM2KJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):97280
                                                                                                                                                                                                                                  Entropy (8bit):5.5755301838041
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9594BC046765DF20F4AC8DED4D1DD5D8
                                                                                                                                                                                                                                  SHA1:95DE0064B529D0EE2A0BC786D3511A9376352847
                                                                                                                                                                                                                                  SHA-256:4C457232DD4B8E3589F2F38F705089BAF568B1E9EC1554A0A3022B39F4286E76
                                                                                                                                                                                                                                  SHA-512:5C1110603239D314AD8216E3503ECB78F40D2C286810E4AF7944AB4FDB0591E96A64268D545CD950696651E2A4E85529F1220A188CF7013DB827D8FA23A5A6B1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[..5...5...5.......5.......5.......5...4...5.......5...K...5.......5.......5.Rich..5.........PE..L.....[J.............................h..............................................vi....@...... ..........................D...d....`...:...........................................................E..@...x...X....................................text............................... ..`.data....k.......X..................@....rsrc....:...`...<...0..............@..@.reloc.."............l..............@..B..[J(...o.[J5.....[J@...~.[JJ...........KERNEL32.dll.msvcrt.dll.ntdll.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ANJBD.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.108383360770395
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F47D21315624368ED09D41021DF1D7AE
                                                                                                                                                                                                                                  SHA1:2FB5A76A88EA5712316A4FC42F66961AFC6590F5
                                                                                                                                                                                                                                  SHA-256:2BA31678405D74B791AFF50DA2671A82F7809130239E3F8C9D21DCE68C0786FA
                                                                                                                                                                                                                                  SHA-512:1442581523B070C722A76ABDC3FECA6A63CDB3EB2E4840FDECBFB756F05AB83E78DD268E577105507F2D9953455C9A0CCC59889FC5B94EDC7560768A0E299597
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......,5....@............................._............ ...................<..............8............................................................................text...?........................... ..`.rsrc........ ......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDSA..6.dN./{b.yXJ....api-ms-win-core-handle-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02..................oX....:.......................0...h...............!...\...}.........................api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32.DuplicateHandle.GetHandleInform

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AOC02.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):179720
                                                                                                                                                                                                                                  Entropy (8bit):6.359467077845955
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FCBF245572EFBDB1E7125A7460717176
                                                                                                                                                                                                                                  SHA1:175BF63842E85637B53885811F767FF47B97621A
                                                                                                                                                                                                                                  SHA-256:580528ECD821F62A2BCDF7DB4C765FCB0A463F8DCF3F6BDF799AFBC423277C14
                                                                                                                                                                                                                                  SHA-512:BE602A22461427DD34742A116E85D7A0D73A2C315193E1321DE7E7BA957FE96A51E250C739B610F2333DAFE9BB467EA437BB5BDAFA793F07236F8D77D743C919
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i..s&...i.......i.......i.......i.......i...i..yi.......i.......i.......i..Rich.i..................PE..L...x..e...........!................................................................K.....@.........................`q..4...\N..x........................*......`....................................#..@............................................text...O........................... ..`.rdata...p.......r..................@..@.data................r..............@....rsrc................t..............@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-AOS3D.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):24584
                                                                                                                                                                                                                                  Entropy (8bit):6.816843310403961
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:33876D098A3F5EA51E20110B80A54A6B
                                                                                                                                                                                                                                  SHA1:0EF862A985946DB2C80D773357C20832D047B1DE
                                                                                                                                                                                                                                  SHA-256:1745EE03859D97A219C21317DCBA234AB8BEC882AA1A51F1CC66D6C732A1EA80
                                                                                                                                                                                                                                  SHA-512:4B5A9130F8EFB78D4F8316E968C9E375CEA6E995C3C5F91BD59EA1C22828820A5B258123C787F48F9C8C11E67039515B953FA33D39E3E0FBBCACA3CE78F1DAEC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..w..Lw..Lw..L~.mLv..L~.{Lz..L~.|Lt..L~.kLp..Lw..L6..L~.rLt..L~.jLv..L~.iLv..LRichw..L........................PE..L......e...........!.................#.......0...............................p.......w....@..........................;......P4..P....P...............6...*...`..8... 1...............................3..@............0...............................text...q........................... ..`.rdata.......0......................@..@.data........@.......,..............@....rsrc........P......................@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B02CC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):60928
                                                                                                                                                                                                                                  Entropy (8bit):4.427907815229371
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:03F005368955CD4B005B1BF8CA592F7A
                                                                                                                                                                                                                                  SHA1:D5F3BF58A262D969C02EE7E590AEA293B8329C75
                                                                                                                                                                                                                                  SHA-256:0A05BE79A6D3FB023001426B56A9D7A76D7DDEA900FB4D6A762E42E4BF510925
                                                                                                                                                                                                                                  SHA-512:6D99FACEFAD9E9E57AC4EEEA4B505DA39EC21EAAE69AAFD3865D937432FB378A440F8A7C9E27DC37EE3BFC375CFCFFC846EE85D4FFC6D053B8B5FEE68927B0DD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]......................................@.............................................`................$...........................................................................................rsrc...`...........................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B3CO4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):4406
                                                                                                                                                                                                                                  Entropy (8bit):3.8446867188940583
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A73B4C16CD25E56CBBBE266DC8520255
                                                                                                                                                                                                                                  SHA1:61B586B5178479170E9E3355B53819D8DCA36738
                                                                                                                                                                                                                                  SHA-256:68064B703BAD5D79A901F68975D7A691FFA155E5172B164C5CBB0A4977066864
                                                                                                                                                                                                                                  SHA-512:D1F037E8557AAD32B304A2D9E898CC47496F5C4DD5CD37210EB44D3A729276759ACECD9F7CE8024B4C83025D12BE01274DB562AF53CA3869361BAEE526B68959
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:..[.L.a.n.g.u.a.g.e.s.].....E.n.g.l.i.s.h.=.r.e.s._.e.n._.U.S.....J.a.p.a.n.e.s.e.=.r.e.s._.j.a._.J.P.....G.e.r.m.a.n.=.r.e.s._.d.e._.D.E.....I.t.a.l.i.a.n.=.r.e.s._.i.t._.I.T.....S.p.a.n.i.s.h.=.r.e.s._.e.s._.E.S.....F.r.e.n.c.h.=.r.e.s._.f.r._.F.R.....P.o.l.i.s.h.=.r.e.s._.p.o.l.a.n.d.....P.o.r.t.u.g.u.e.s.e.=.r.e.s._.p.o.r.t.u.g.a.l.....C.h.i.n.e.s.e.=.r.e.s._.z.h._.C.N.....C.h.i.n.e.s.e.T.r.a.d.=.r.e.s._.z.h._.T.W.....K.o.r.e.a.n.=.r.e.s._.k.o._.K.R.....T.h.a.i.=.r.e.s._.t.h._.T.H.....M.a.l.a.y.=.r.e.s._.m.s._.M.Y.........[.E.n.g.l.i.s.h.].....P.r.o.g.r.a.m.O.n.T.h.e.W.e.b.=.V.i.s.i.t. .E.a.s.e.U.S. .o.n. .t.h.e. .W.e.b...u.r.l.....G.e.n.e.r.a.t.e.R.e.p.o.r.t.=.G.e.n.e.r.a.t.e. .r.e.p.o.r.t...l.n.k.....U.n.i.n.s.t.a.l.l.P.r.o.g.r.a.m.=.U.n.i.n.s.t.a.l.l. .%.s...l.n.k.....H.e.l.p.=.%.s. .H.e.l.p...u.r.l.........[.F.r.e.n.c.h.].....P.r.o.g.r.a.m.O.n.T.h.e.W.e.b.=.P.a.g.e. .d.'.a.c.c.u.e.i.l. .d.e. .E.a.s.e.U.S. .T.o.d.o. .B.a.c.k.u.p. .V.i.s.i.t.e.r. .E.a.s.e.U.S...u.r.l.....G.e.n.e.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B8191.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):203784
                                                                                                                                                                                                                                  Entropy (8bit):6.953964280584855
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:29BC56F0D96AE2D9E1748F7D5F68EB52
                                                                                                                                                                                                                                  SHA1:3BA069976D2160A0F5B645686D8E32D62994CB22
                                                                                                                                                                                                                                  SHA-256:913678468942D5CAA99D8B8C7224E48EB1E667D4404E5E09048A7B794167B23D
                                                                                                                                                                                                                                  SHA-512:864BBAF472BB1F748DD08FCBCDDB4CB3635E9F23CF3C1D1DA20C85E91A3D90BDD83EBAB78483999652749B9D9ECFF7DFAF75F88A8A2A8CC7BE7CD8289048595A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........wyPu.*Pu.*Pu.*?..+Zu.*?..+.u.*?..+Bu.*...+Bu.*...+Cu.*...+wu.*?..+Yu.*Pu.*9u.*...+Ru.*...*Qu.*Pu.*Qu.*...+Qu.*RichPu.*................PE..L...=..e.................x...v......0R............@.......................... ..................................................d....0..H................*..............T...........................H...@............................................text....v.......x.................. ..`.rdata...|.......~...|..............@..@.data...............................@....rsrc...H....0......................@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B90EE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1857
                                                                                                                                                                                                                                  Entropy (8bit):5.379091022433406
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4F9ED5EFA4F7B75BCFE0F36C36EE5CB6
                                                                                                                                                                                                                                  SHA1:29F568508A65F5177C6044544248893A876A666F
                                                                                                                                                                                                                                  SHA-256:FF718390133B400EE679177B2902BBB918DB148BBB4ABABA03D0A1DF325B3303
                                                                                                                                                                                                                                  SHA-512:A94AA869B8420D3965FAD7B05E1E894E8CA00465CD8C2BE2AC135F44D0689AFA7257BB468C69B7BB33BBB036D6B66FBC693C964BF17A85A209AEEE9F8DFFC3CD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="e0dcdcbfcb452747da530fae6b000d47c8674671"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>KSaO8M0iCtPF6YEr79P1dZsnomY=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="81efe890e4ef2615c0bb4dda7b94bea177c86ebd"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-B9G3T.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):103432
                                                                                                                                                                                                                                  Entropy (8bit):6.625505351723528
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:767001AD236F571BE1EEDC949896F579
                                                                                                                                                                                                                                  SHA1:68DB754E20455F4D790CB1BBC7BD8BAF1BEAEF59
                                                                                                                                                                                                                                  SHA-256:B1F0101DD0FB4DD055615B9B701FEDD4BC1654DAD511D222E62E67705B2AD944
                                                                                                                                                                                                                                  SHA-512:4EF9382F537524431EA7D1DADC7C671CCA8E63C4E97FDE08030A852B80E41B75009206D6A698D8DD30DFEABE98CCC1850C5B3DF0333DB63E904DD16676B268BA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..7~..d~..d~..d.rd|..dw.qdy..dw.gdq..dw.`dy..dw.wdy..d~..d...dw.ndy..dw.vd...dw.ud...dRich~..d................PE..L......e...........!.........~............................................................@..........................e..e...$X..P....................j...*...........................................J..@............................................text............................... ..`.rdata..Uf.......h..................@..@.data........p.......T..............@....rsrc................X..............@..@.reloc..4............\..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BA2NJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):23048
                                                                                                                                                                                                                                  Entropy (8bit):6.790359047463914
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:33C8C405A55735E2A909779BDAC4CBB0
                                                                                                                                                                                                                                  SHA1:DE7857E767B9B13A44B5C19E78D42EE3FCCB08D9
                                                                                                                                                                                                                                  SHA-256:A97007E812D9063672E26F8E8C7317A167F325FB039043609CEAEF1791859A21
                                                                                                                                                                                                                                  SHA-512:16FB1C410B967C496113A32D06CEEF82B23DC96BF7AD16FEE6154C551D1A308EA08940F212F54B25539749CC2CDBA198E3683F2A2664F4BAA80F95EF9BB06E23
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.Lo.."<.."<.."<..<.."<..<.."<..<.."<..<.."<..<.."<..#<8."<..<.."<..<.."<...<.."<..<.."<Rich.."<........PE..L......e...........!.........................0...............................p............@.........................P:..f....5..<....P...............0...*...`.......0...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..X....`.......,..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BBNRU.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):330248
                                                                                                                                                                                                                                  Entropy (8bit):6.227155106371795
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:88FC4AE11DB6A4C0841EBDA30F88CF65
                                                                                                                                                                                                                                  SHA1:83BCD113BDA798A7222994056B252BF8D13E3CE5
                                                                                                                                                                                                                                  SHA-256:2F4D8489BD37BCD597FC485436ED1FA57AE107CBFFCFB693DCF158EB4951D097
                                                                                                                                                                                                                                  SHA-512:9744BC60BB271610DEB515B834324B0AB49793D2EF96593FF138B8028B756ECBE6724912471E8F3BC2B75959B36A1B2CE9C10C34B80F37D070D10D1FA8A200BF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.Ch.VCh.VCh.V.'.VBh.VJ..VEh.VJ..VMh.VJ..VJh.VJ..VNh.VCh.V>h.VJ..VNh.VJ..VBh.VJ..VBh.VRichCh.V........PE..L......e...........!.....F..........-+.......`.......................................I....@.............................................................*......D...@b..............................x...@............`...............................text....D.......F.................. ..`.rdata..@k...`...l...J..............@..@.data...@...........................@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BBPJ6.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):24256
                                                                                                                                                                                                                                  Entropy (8bit):6.86696990776101
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:549F6735F986E1DDC0C85A3502052FEC
                                                                                                                                                                                                                                  SHA1:4CF90329F18993C0982CACC1D718E0308176971B
                                                                                                                                                                                                                                  SHA-256:8824840D84F561D2B46D13F30484683C36328850A596F1E2EE48BCA2E7DE2D30
                                                                                                                                                                                                                                  SHA-512:51FF305D59E2D1A365095406E9F56B28E57CD95AC36955D93A8F2D6B3DD3D474B30643CF527A67760C540E83517AEE2F743214C931CF5E58BC79AE016A47B64F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...u0oX...........!.........................0...............................@...........@.............................a............0..............."...<..............8............................................................................text...A........................... ..`.rsrc........0......................@..@....u0oX........8...8...8.......u0oX........d...p...p...RSDS].[=.0B....w.....api-ms-win-crt-stdio-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02......................oX....>...........................n...................Y...............H...............=...x...........(...e...............$...>...V...n...........................4...U...w.......................:...[...}...................1...U...w................ ..' ..J ..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BD949.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):86024
                                                                                                                                                                                                                                  Entropy (8bit):6.302451746586348
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9AE04F4235F4018A10E181EC47D28162
                                                                                                                                                                                                                                  SHA1:CA709609EFA2DAA30EF4C3255DF66FB159EB04D7
                                                                                                                                                                                                                                  SHA-256:540D518B1AD31AA0E277E4969B29B904E0F773AF31A8947BBE121D74FC57F7D3
                                                                                                                                                                                                                                  SHA-512:3A1B66AA02351C86680086F37F437A7BBF55FB5A038E933AF0B3E8826ECA65939870C63AD36CC66E9A7E2FEF9F77169DC022F1E41FFD967C6623F98E1AB874E4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......An...............@.......w.......w.......w.......w..........\....w.......w.......w......Rich............PE..L...Y..e...........!.........\......[........................................`............@..........................(..k...L...x....@...............&...*...P..........................................@...............x............................text............................... ..`.rdata...H.......J..................@..@.data........0......................@....rsrc........@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BD9O5.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):131080
                                                                                                                                                                                                                                  Entropy (8bit):6.317268844098906
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F53E1A71AB26A2BAF7DD28390020C5CA
                                                                                                                                                                                                                                  SHA1:D73F14B5AE7A5393C0F3792EEB4C7A2CE985E3A0
                                                                                                                                                                                                                                  SHA-256:B84E02A73E09F04B3842BB4DB4BBE3FFE9BC2943DACB98EFC614A49FD43B7EB7
                                                                                                                                                                                                                                  SHA-512:0941AD95BAA0309A13C1D598721D80491A232D1E067CC65D99583D10DF54D9E5E9EEA692E49497E85972AFDE63C5DF26B6E2E7A999DFFF8B6DFCCD0576D56403
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.b.$...$...$.....&...-...'...-..*...-......-...-...$......-.."...-...%...-...%...Rich$...........PE..L...\..e...........!.....$..........k........@............................... ...........@.........................0.......,...d........................*...........B..................................@............@..\............................text...z#.......$.................. ..`.rdata......@.......(..............@..@.data...d...........................@....rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BG0LR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):23024
                                                                                                                                                                                                                                  Entropy (8bit):6.3575722696909756
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:371AEB50F7816108B346B67EF2B11E1A
                                                                                                                                                                                                                                  SHA1:5DE780B46D7663D1615727EDABA32B5709286D38
                                                                                                                                                                                                                                  SHA-256:12903D93A7F57B479401602A533849E6F813FF5C2C92F3A02D468FC98E7AC1D5
                                                                                                                                                                                                                                  SHA-512:4AFF94ADBD97948766C7839220E15000A4DEFB7D46B5502872B16225E8C5B85B6B674B632455AFBB3DB729D5F2E9666B32B8DB282EA3499EBD84FE4CE11D9631
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u...u...u......u...t...u..t...u...p...u...q...u...v...u.E.t...u...t..u.E.p...u.E.u...u.E.....u.......u.E.w...u.Rich..u.........PE..L....._...........!.........*...............0............................................@..........................5.......>..d....`..H............>.......p.......1..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....rsrc...H....`.......6..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BHP96.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.172788162832863
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DD18F031EC7ADD5DB85E3CFA1D7DD735
                                                                                                                                                                                                                                  SHA1:FE13CC8E258D52A4A67A5551DE660BFDAD547632
                                                                                                                                                                                                                                  SHA-256:1771E45579E879B6465F4074FAEA12C2F6CDBBD24CA1A84ADFF4C6A54BA8FB4D
                                                                                                                                                                                                                                  SHA-512:440F05C296FDB58F0522FCC1D7103C9B33BDC382675E36251F233FBEBC66B54CFFB1B9124E1F345655763FF98511A6B64B9B351C8D2F30C46BF2503F2D983D6C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......8....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDS+.D+.XC......e.....api-ms-win-core-heap-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX........................H..............."...A...a.......................3...X...v...........................5...V...u................... ...O...j...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.kernel32.GetProce

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BK9TS.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):90112
                                                                                                                                                                                                                                  Entropy (8bit):5.412628537282741
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E66211F9DD062CB43A8543A8E0E845D1
                                                                                                                                                                                                                                  SHA1:6F62412303DDC9132F67B549ED1E8C4FE3142B40
                                                                                                                                                                                                                                  SHA-256:1960ACB6F59DA5FB8BE25FEEC0E1B9736D7EAD75B0F57D772025806046D198C7
                                                                                                                                                                                                                                  SHA-512:E8FCEB24C7C32AE553A5F4942F3EEA33B51CFC7F7378027578D37483B2887EDC0D98F2B29B1EFE379BA52A2DEDF92E1D9D9D1A1BBFF408FF34D393872B53AD5B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.. .. .. ..[.."..B.."..O..".....#..O..$..O.."..Y..".. .....Y..#..&..3.....!....#..Rich ..................PE..L......K...........!.........0..........................................................................................F.......d.......H.......................(....................................................................................text...U........................... ..`.rdata..F...........................@..@.data...$...........................@....rsrc...H............@..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BMCT2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):263176
                                                                                                                                                                                                                                  Entropy (8bit):6.231193952320442
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:78E25F9FC1E21FBBE85B1C7CBE387F05
                                                                                                                                                                                                                                  SHA1:E7AEF4502D7EC0A0FC0208002BEB1F2A91B315C0
                                                                                                                                                                                                                                  SHA-256:FFFE2AA2C3E8CF671A7813914A78EBD66BE6389CCD5CC696969F36076A2CD94B
                                                                                                                                                                                                                                  SHA-512:E5561530CD604639BFAA304BEB094C8DDFE86B3BF06B3FF9D55AA288B506E9B21E8144E393CF853BBE549C17BBECE7C6E56F66CBEACDB422C21DDAEB18D4598D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.R..f<..f<..f<..)...f<......f<......f<......f<......f<..f=..f<......f<......f<......f<.Rich.f<.........................PE..L...Z..e...........!......................................................... ......cJ....@......................... ....................................*...........................................i..@...............H............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..H&.......(..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BRKC5.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):132104
                                                                                                                                                                                                                                  Entropy (8bit):5.801172564139572
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:116C0C74DD12A7EED10BFB47D7B01765
                                                                                                                                                                                                                                  SHA1:D57E84C39486BD7DA72086B624E6412836ACD77D
                                                                                                                                                                                                                                  SHA-256:6665C79B7C89D7DC925BCE022104A941764EB67B99A3709464BFC37605502A30
                                                                                                                                                                                                                                  SHA-512:D4103F1842F61C1F94A282995A1F280EAC839FCE1AAE74B4569215BC3E2465030F0B5865A92FE702EEF2EBF1F9E4271D6F9EC5385336BC3CCB7E0FBE7BC50D41
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..!*.r*.r*.r#..rd.r#..r .r#..r..r#..r#.r*.rY.r#..r..r4..r+.r#..r+.rRich*.r........PE..d......e.........."..........*.......B.........@............................. ............@.....................................................d....@..H....0..L........*..............................................................8............................text...2........................... ..`.rdata..\?.......@..................@..@.data...x'..........................@....pdata..L....0......................@..@.rsrc...H....@......................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-BSCFV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):104861
                                                                                                                                                                                                                                  Entropy (8bit):5.949585097997395
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9F95ECE3D2B3909DE4D9147C4D93F976
                                                                                                                                                                                                                                  SHA1:CBF031A011BB6B3CC38D368B2BD0B5A081076AC9
                                                                                                                                                                                                                                  SHA-256:52FFCD48615D9DE3FDB6B5892149263070DE4B349871269FC6E8539F81DFF61C
                                                                                                                                                                                                                                  SHA-512:FA60865BBE4B1D695B66D3697557947CD764B579344BD5AF14369BE33BF4388A010139C021AB44E68A1828122D2749FFB3EEA4CE06FC99911AE44BD71F5AE269
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7..G...........#...8...........................i.........................p......`......... ......................0.......@.......P.......................`.......................................................................................text...t...........................`..`.data...............................@....rdata...!......."..................@..@.bss......... ...........................edata.......0......................@..@.idata.......@......................@....rsrc........P......................@....reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C06JV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):90120
                                                                                                                                                                                                                                  Entropy (8bit):6.452213608261776
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:25564BA861216215698E0746DD5D8CFA
                                                                                                                                                                                                                                  SHA1:6C1CE8697057C364F618ECC06592E8C0743ADC90
                                                                                                                                                                                                                                  SHA-256:40735C54F545E2CB80BD642B86CC0F83BE9D3803237BF6789E921F00B57393D3
                                                                                                                                                                                                                                  SHA-512:E5D820AAB94DDB8F9DE327DDA835074DFD6A7E8E500D28ECB6576D2D62847093C40876BFD8A92F1A0EE56A8AEF9E475CE5C5AC8C923385AD8AD7DCDDD18ECB28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........J..J..J......K..C.-.M..C.;.E..C.<.C..C.+.E..J.....C.2.M..C.*.K..C.).K..RichJ..................PE..L...z..e...........!.........T...............................................`......dB....@.........................`*...............@...............6...*...P......@...................................@...............$............................text............................... ..`.rdata...:.......<..................@..@.data........0......................@....rsrc........@.......$..............@..@.reloc.......P.......(..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C3AJ2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):776024
                                                                                                                                                                                                                                  Entropy (8bit):6.597864383424773
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9160F18CA5FF12FBFF70D0498D3295B0
                                                                                                                                                                                                                                  SHA1:7F7AFB23D0DC7CC47FDAF2B94976B51C5FB4BCB0
                                                                                                                                                                                                                                  SHA-256:6BD850DDC0CECBCFD14248CCFD5861A30C4BE3ED8320B86FDDDC631DE9CD4E39
                                                                                                                                                                                                                                  SHA-512:8A3C3A4D72AD9DA4018DC65BB91F632F8605BA6AC5B054AA233C0E04639AC41897A509A4B7E9F51621FE31F4F00A9138D243F0601F360246D223FB292469CBA9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................(.*....).........8.....?..../.........6.........-...Rich...........PE..L......`...........!.....|...L.......O....................................... ......d ....@.........................@,..:...<...........................X.......DZ..P...................................@...............P............................text....z.......|.................. ..`.rdata..z...........................@..@.data....?...@... ..................@....tls.................N..............@....rsrc................P..............@..@.reloc...x.......z...R..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C6HET.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):7674
                                                                                                                                                                                                                                  Entropy (8bit):4.613677539918445
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BFE418E75E45407A8AF01537837BBE16
                                                                                                                                                                                                                                  SHA1:317F92E50D8B31A88B6873F9D6806515122F88E6
                                                                                                                                                                                                                                  SHA-256:3A0D27BDC01A92D6A9D5B2F14A160A614748ABE8CDB0AD6823F47EE388E6F37C
                                                                                                                                                                                                                                  SHA-512:CA0FDB9112F66D2B7DC91F953A50860DB2F23B6BFE67A212336D39D168EA8866CC655702BA54108BE0386F0C4DC739F8BD4B997BDE0D4EA15451C0B6B48B61AA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:386..386.png..3ds..3ds.png..3g2..sp.png..3gp..sp.png..3gp2..sp.png..3gpp..sp.png..7z..ys.png..8ba..333.png..8bc..333.png..8be..333.png..8bf..222.png..8bi..222.png..8bp..44.png..8bs..44.png..8bx..44.png..8by..44.png..8bl..44.png..aa..aa.png..abr..ones.exe.png..ac3..sp.png..acb..222.png..acbl..222.png..acc..sp.png..ace..ys.png..acf..acf.png..acl..acl.png..aco..aco.png..pdf..pdf.png..act..sp.png..acv..ahu.png..acw..acw.png..adcp..adcp.png..ado..ado.png..adpp..adpp.png..advs..advs.png..ahs..ahs.png..ahu..ahu.png..ai..ai.png..aia..aia.png..aif..sp.png..aifc..sp.png..aiff..sp.png..aip..aip.png..air..air.png..ait..ait.png..ameproj..ameproj.png..amp..5.png..amr..sp.png..ams..5.png..ant..ant.png..ape..4.png..api..api.png..apl..apl.png..apln..apln..application..application.png..appref-ms..appref-ms.png..arx..arx.png..arj..ys.png..as..as.png..asa..jsp.png..asax..wtx.png..asc..as.png..ascx..wtx.png..asf..sp.png..ashx..wtx.png..asl..asl.png..asmx..wtx.png..asnd..Adobe Soundbooth-6.png..asp..asp.png

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-C6MV1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):28168
                                                                                                                                                                                                                                  Entropy (8bit):6.876032621441002
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:167FD7761A717F5FBD7AC129F76A1FCA
                                                                                                                                                                                                                                  SHA1:B9519A43EEFEE0839FF2B3A35192C568322B341D
                                                                                                                                                                                                                                  SHA-256:A024965D07C460A129D85683C55880B8FFD6CF772268CEAF8CE8235E6C93950E
                                                                                                                                                                                                                                  SHA-512:6835936E8FD530DAFAD11D7D17E57FD546CC9A26E1E30AFA67E19A80DD4E72331FCD46AC435B9DF6017958B57336D1333B58A3B29D38E7417D0DDA80A6AF8076
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................y.{.....x.....i.....n.....~...........g...........|....Rich...........................PE..L...I..e...........!........."......e&.......0......................................cs....@..........................C..i...\>..P....`...............D...*...p..L....1...............................9..@............0...............................text...[........................... ..`.rdata..I....0......."..............@..@.data...L....P.......8..............@....rsrc........`.......:..............@..@.reloc.......p.......>..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CAMT1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):75784
                                                                                                                                                                                                                                  Entropy (8bit):6.529897983611105
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4D841C9C26D229023CA7069A93E542CD
                                                                                                                                                                                                                                  SHA1:687F2B10BA385050F477C882D8647FA89C098946
                                                                                                                                                                                                                                  SHA-256:458A937B30C6BE54B4AABACBCE83914E50BCF5791FB1F89811C10AD79A5176C4
                                                                                                                                                                                                                                  SHA-512:705F774689AB2BB4C81B9254074329E475355CF9703CEA6A5F3A785332C596F712C5FB24CF024C1F35DA7F8FA57F893BA49AFF71A373332A9CCA12F64586F14A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..O..O..O.{...O.....O.....O......O.....O..N.B.O......O.....O.....O.Rich.O.........PE..L...A..e...........!.........L...............................................0......D.....@.............................g................................*... ..........................................@............................................text...+........................... ..`.rdata..g3.......4..................@..@.data...T...........................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CFC5M.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):41984
                                                                                                                                                                                                                                  Entropy (8bit):5.336808101026051
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F3C53B5B47AB2D76FE2BBD7B3410FD63
                                                                                                                                                                                                                                  SHA1:21D8AFDF6269233AAFE2AD0C5B04E0CF0D7D1659
                                                                                                                                                                                                                                  SHA-256:416641841917752D9EA6D90FF3D59E1FBF59B5BCFA9F9FFCF2900BFA3C76603D
                                                                                                                                                                                                                                  SHA-512:05569BDDC3A0E48F148865CD501F93CA8CA59C38B5BFF36F75006971FD2B120956E261352F3AE6CC49622CABA936794D355E61ADB6D7106408DA0AC933B4FFF3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!.........~....................6]......................................@..............................................}...............$...........................................................................................rsrc....}.......~..................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CGBM2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):54272
                                                                                                                                                                                                                                  Entropy (8bit):4.49141712082068
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3BE57351529E0F2BA7742CDF2B05316B
                                                                                                                                                                                                                                  SHA1:61102D15DC8A80B84CBEF5807B3573F09EDD5E0C
                                                                                                                                                                                                                                  SHA-256:A3E2C202E556791DEE9D18962CA6780761B415313BCD104C2E621BA4089801A4
                                                                                                                                                                                                                                  SHA-512:F44BC0496A0DACBA04C4CFA8050109B946A0F3158FD544F7D45841013FF394338793C9EA6BDAD1095AB5A837451F00C595C640287AD5E12F408CEEBCE4A226B0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]......................................@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CIS5G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):201736
                                                                                                                                                                                                                                  Entropy (8bit):6.318866796733451
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2989E6A612EF39C3BB415C91834287C8
                                                                                                                                                                                                                                  SHA1:C368C7FD3F0062D0DDA5B1822AC411B90C0733AC
                                                                                                                                                                                                                                  SHA-256:5C046315183F9CF79BFF63CA225441F1768C041BCB1E56E0404001A8CF6E02E1
                                                                                                                                                                                                                                  SHA-512:F1E2394315CBCDB49FB1B632BE09393ABF737B77C994D541DF9EB7CF897573D901883140FDD30D5BA5CDC6E48F82A2F9C1C831558FF35925DBB2214B482218F7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7..V.V.V...v..V..u..V..c..V..d..V..s..V.V..V..j..V..r..V..q..V.Rich.V.........PE..L...}..e...........!................v........ ............................... ............@......................... .......<...x........................*......L....#...............................}..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...............................@..@.reloc..V#.......$..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CM055.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):25608
                                                                                                                                                                                                                                  Entropy (8bit):6.737619073723929
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:69DF3445AB737D93ACEE937B31A7BC05
                                                                                                                                                                                                                                  SHA1:95463BB746A1C6FA32B6F9714FA4B245B985E1B9
                                                                                                                                                                                                                                  SHA-256:0D3C9747C0A12DF128FCAF58F23C5E6C4C78DB5B6F34E38AF06A3391252422BA
                                                                                                                                                                                                                                  SHA-512:76DB241C1A0DE769D0196C828CEF32D6D236A91B1860DE9C35B1DF5B0F4082FA49651BD7964E4262E1023B8EEA6880B005ED804EF1E7DD1D5FB89E55B55F0D9F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.oSu.oSu.oS...St.oS|..St.oS|..Sx.oS|..Sq.oS|..Sr.oSu.nSM.oS|..Sv.oS|..St.oSk..St.oS|..St.oSRichu.oS................PE..L......e...........!................. .......0...............................p............@.........................0>..i....8..P....P...............:...*...`..0....1..............................(4..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......,..............@....rsrc........P......................@..@.reloc.......`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CPCGC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):776472
                                                                                                                                                                                                                                  Entropy (8bit):6.894619930115511
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:14C8B0D022CDD56939E5385CBCAB60A6
                                                                                                                                                                                                                                  SHA1:B47A20174D1DAB0E2901C42BFBED251BE633280C
                                                                                                                                                                                                                                  SHA-256:A80846377F8E6BAAD467F4B0064CF929CF51629BAAF47044B7CB3F3C4E627476
                                                                                                                                                                                                                                  SHA-512:D43A4333AD0C7E1A99CBB6C069843865B354CD9BF2D5460CE0400E1AF38D7A24BE12E33215DBFCAABC16C082758EA3772CDA28086FE0405FA08DDF7BB91B21F7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...h.i.h.i.h.i.a...D.i.3.h.m.i.h.h..i.3.j...i.3.i.i.i.3.l..i.3.m...i.3..i.i.3.k.i.i.Richh.i.........PE..L.....X...........!.................[....... ......................................hx....@A.............................x...............................=......d7..P...T............................................................................text...n........................... ..`.data....]... ...<..................@....idata..8............J..............@..@.rsrc................`..............@..@.reloc..d7.......8...d..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-CRJCF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.1628223545540886
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EB40677933FADCE08384BAA315DF6A6F
                                                                                                                                                                                                                                  SHA1:4DB8CC6BE9B42DC1EBE68C5B638D17AD9561A866
                                                                                                                                                                                                                                  SHA-256:504C016932749167FE0178DDA460D1CCAE6E415DFBCD777220205ADF90F2C571
                                                                                                                                                                                                                                  SHA-512:44E47535526344B61B4ADA446ABB968B5AA369869347CDDB4D3E21A061A8DA3EDC61250AD9E49F874621D782AA492DB4770B0A94D070E5355D2207666818B17A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text...q........................... ..`.rsrc........ ......................@..@....^*oX........=...8...8.......^*oX........d...x...x...RSDS..12.l?G......>s....api-ms-win-core-namedpipe-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX....l...................0...X...................W.............../...Y...................7...................J.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedPipeW.kernel32.CreateNamedPipeW.C

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D0TCV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):20672
                                                                                                                                                                                                                                  Entropy (8bit):7.087298066174868
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:755B7023ED998486D9029F56C52CDD74
                                                                                                                                                                                                                                  SHA1:DBE7F8BAD220E3D000B0ABD18E4B36697F96E6E0
                                                                                                                                                                                                                                  SHA-256:08A74C3C146BFDDD7236C63E83E5CFB98EBE4595155A8954B50D1F0E60067521
                                                                                                                                                                                                                                  SHA-512:3590531682857E93C8A911E9B9D04F34FE5E49BC78A29804CF0C1CC974DC523C6D695837FB0DB6EE6D1C6093ACDADFF3B19768E751E9C7DBDDA232C95CDBD798
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......'.....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........@...8...8.......^*oX........d...x...x...RSDS.w..2FB...o..{....api-ms-win-core-louserzation-l1-2-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX....V.......;...;...............................F...m.......................=...i...................)...Q...w...................c...............J...y...............>...p...................<...h...................@...d...................0...g...............

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D60HO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1291264
                                                                                                                                                                                                                                  Entropy (8bit):6.746889281284923
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E75D9887E0A9A6FBB812B629F8EA0916
                                                                                                                                                                                                                                  SHA1:2457DDDCC5CD945260E2599FFAF367514D156875
                                                                                                                                                                                                                                  SHA-256:82E916EF03117F214BC3E870FEFDDD4FC422854C27BDA75AB272BB0AAC6B7A12
                                                                                                                                                                                                                                  SHA-512:38C1BD7824D8BBC037BFA0696A3064A06C4E53685BE39509BFE3C4F1484691A0BAA3B5A1FFA6244E4E25CA31968C3EA004BA0A8A7EC39EFF2EDC67D1E6384410
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... 0VE...........#...8............`.............Pc.........................0......L......... ..............................p.. ....................................................................................................................text...P........................... ..`.data...............................@....ctors..............................@....rdata...S... ...T..................@..@.bss.....................................edata...............@..............@..@.idata.. ....p......................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-D83JQ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):23560
                                                                                                                                                                                                                                  Entropy (8bit):6.828459194547909
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E1512AF606517FBEDA2E508E228091EB
                                                                                                                                                                                                                                  SHA1:53DDA9D512CC28565F82C686C16830CDA23543CC
                                                                                                                                                                                                                                  SHA-256:D30A474E755A908A07394768B041EDA4CA9143CEAB9AFFE11BA0B29C1E3317F3
                                                                                                                                                                                                                                  SHA-512:DCFDC0978F9A267CA521B9B4CE34B69A5A7856F4EFAC9490537BEF85C926744A6015A890DAD2B6935E2FFE6ABC87CB2C1B0891E066A35C3A1AD62B6AD4387327
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................c...............................................Rich...........................PE..L...U..e.....................................0....@..........................p......9D....@..................................7..P....P...............2...*...`...... 1...............................3..@............0...............................text............................... ..`.rdata..v....0......................@..@.data........@.......(..............@....rsrc........P.......*..............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DADTJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):3466856
                                                                                                                                                                                                                                  Entropy (8bit):6.444422172074855
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C5B362BCE86BB0AD3149C4540201331D
                                                                                                                                                                                                                                  SHA1:91BC4989345A4E26F06C0C781A21A27D4EE9BACD
                                                                                                                                                                                                                                  SHA-256:EFBDBBCD0D954F8FDC53467DE5D89AD525E4E4A9CFFF8A15D07C6FDB350C407F
                                                                                                                                                                                                                                  SHA-512:82FA22F6509334A6A481B0731DE1898AA70D2CF3A35F81C4A91FFFE0F4C4DD727C8D6A238C778ADC7678DFCF1BC81011A9EFF2DEE912E6B14F93CA3600D62DDD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.X.0.X.0.X=.DX.0.X=.EX.0.X..DX.0.X..FX.0.X.0.X.0.X..@X.0.X..EX.0.X..AX.0.X..XX@0.X..BX.0.X..GX.0.XRich.0.X................PE..L...n..R...........!......1.........7.0.......1..............................`5.......5...@...........................1.u... .2.d.....2.@.............4.h<....2....p...............................h...@.............2. ............................text...%.1.......1................. ..`.data...<.....1..^....1.............@....idata........2.......1.............@..@.rsrc...@.....2.......1.............@..@.reloc........2.......2.............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DFFS4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):30216
                                                                                                                                                                                                                                  Entropy (8bit):6.80265972569772
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:482D2DBAAC351B014B01F9A5BB3BCC57
                                                                                                                                                                                                                                  SHA1:54E585CF4E0DB2B6F69369B557EDBDF54C61A2C5
                                                                                                                                                                                                                                  SHA-256:E8C8537A94F1EC3B044C8680B381425A51ADDA34CE56572E6B14C1C8EE677B7B
                                                                                                                                                                                                                                  SHA-512:46C5949D610757A57017B3759C73ADB7C0A1F897A73844118EE65E5B4D0D92BB93EF544DEC5A17D3468F1D68CA7AF0877A2913540BD2A8ECD900E21748F15195
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f..f..f......f.....f.....f.....f.....f..g...f.....f.....f.....f.Rich..f.................PE..L...@..e...........!.....&..."...............@...........................................@.........................`R......`K..P....p...............L...*......4... A..............................xC..@............@...............................text...+%.......&.................. ..`.rdata..K....@.......*..............@..@.data........`.......>..............@....rsrc........p.......B..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DGQB0.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):176648
                                                                                                                                                                                                                                  Entropy (8bit):6.242651436082861
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C53D0D6527A89589FC5BAAE33033F716
                                                                                                                                                                                                                                  SHA1:C2BC070A727B4B90289688F0C34B21AA43AD4F81
                                                                                                                                                                                                                                  SHA-256:1987C7F4D02AD4FEA9CD26553F3D8030A78EC3F7B8560AC5D6B33413E9A6CCBD
                                                                                                                                                                                                                                  SHA-512:38114B7FB5F12CF633F2F35F26280E4DBF157A32F0BF18658C03138E455039810E898E07CAAB438C74D4EBB8138F009771CA8871AA2CF12134F1C6100681B918
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r[.P.5.P.5.P.5..\..R.5.Yk..T.5.Yk..^.5.Yk..Y.5.Yk..A.5.P.4...5.Yk..[.5.Yk..Q.5.NA..Q.5.Yk..Q.5.RichP.5.................PE..L......e...........!.....................................................................@..........................m......PV...........................*...... ....................................9..@............................................text...o........................... ..`.rdata..............................@..@.data...x....p.......b..............@....rsrc................h..............@..@.reloc...............p..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DHH6O.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):19136
                                                                                                                                                                                                                                  Entropy (8bit):7.072320892132067
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E857894AC70983971930040E7A49F150
                                                                                                                                                                                                                                  SHA1:856EB496C2430D13D37786B8C7A6E952EE3780C3
                                                                                                                                                                                                                                  SHA-256:41999A1A13DAD1469845960439F55810BD5DF2BAB70671D2EF0BCED0F76B19B5
                                                                                                                                                                                                                                  SHA-512:EB01DC1C853496480F7A4436FAEDD63261A03BF285D1D93E4B8FFB68B38B1BF03E215A6468645AE07E6BD6685568DFD0BBE38FF42ABCA2FA8BC162AD85D47726
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......5P....@.............................E............ ...................<..............8............................................................................text...%........................... ..`.rsrc........ ......................@..@....^*oX........;...8...8.......^*oX........d...t...t...RSDS.)h....D.)./.h[....api-ms-win-core-sysinfo-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................`...........I...r..............._...................S...................-...R...~...................6...e...............K...|...............8...w...................D...i...........................................................api-

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DI6HD.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):262144
                                                                                                                                                                                                                                  Entropy (8bit):0.1222444171409896
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A7B72570D9B146D16306B8BD3BCF08CC
                                                                                                                                                                                                                                  SHA1:E84089E3C96C8ED11D5F3BF4D011590E8F673378
                                                                                                                                                                                                                                  SHA-256:29546D3B8C9A0F423D1D6DDAF5A3E77FDB8C9A014ADD42977FA9C4DD9B167DD5
                                                                                                                                                                                                                                  SHA-512:9DDD03BEF826AB48263CB4376380860F6BC23505106D8C77618CAC36DCA3A59C8409AD2A01840A13C88042B8179DEEEB71823B6A5895BF14F4A9F7868B44732E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:regfh...h....A..................... .... ......T.B.N.e.t.\.O.u.t.p.u.t.\.T.o.o.l.s.\.E.S.L.O.A.D.E.R...R.E.G..........N.PV..........N.PV..............N.PV...rmtm....................................................................................................................................................................................................................................................................................................................................................\...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DJORB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):20160
                                                                                                                                                                                                                                  Entropy (8bit):7.091557360059544
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:365BB8433FFFDEAF5EA19266823EE5DF
                                                                                                                                                                                                                                  SHA1:41E5C3B5B31D54FFD7B1621F8032D5D05771BB3D
                                                                                                                                                                                                                                  SHA-256:4C72124FDFDD3D698FC61C3A7098D8E6ED032DE3696C262F53D29AB2F0C9DC6B
                                                                                                                                                                                                                                  SHA-512:6321FB96B724D5750BF7EF493F381273EC55351A323118BEF67326848DA251C27EDD355C8DF1E06F35DFBE6C57DA25B7B92853B67600533DAD8F92B0ABFB1279
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......w....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........B...8...8.......^*oX........d...|...|...RSDS;.7..eI.N.VK>o.....api-ms-win-core-processthreads-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........oX............1...1...............+...X...................@...s...............#...Q...~...................Y...................)...[..............."...P...................C...............(...X...~...................3...P...q...........C...v..............."...

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DK09K.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):26120
                                                                                                                                                                                                                                  Entropy (8bit):6.91238433157457
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:11D1CDF8CEF2F0251ED555B0951B70A7
                                                                                                                                                                                                                                  SHA1:3E95C3E4E8646C3D1DB6FB58E98E7CB2763CA78C
                                                                                                                                                                                                                                  SHA-256:8084B9B8443B2FB7CF8DAD825AB68C8FEDC916E3137AF7EAD8783056963B33E6
                                                                                                                                                                                                                                  SHA-512:5268932ED4359FF908A5AC50771F833CF0CE2B02CD9ED4C7CFF1D515E7C6C409BFC3C30D36F8CB585CB2A632838C2FF73A68164E87F95E42743D2182E6F35596
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h)...GR..GR..GR.F.R..GR.q.R..GR.q.R..GR.q.R..GR.q.R..GR..FR..GR.q.R..GR.q.R..GR.q.R..GRRich..GR........................PE..L......e...........!................%%.......0...............................p.......?....@......................... <..9....5..P....P...............<...*...`.......1...............................1..@............0...............................text............................... ..`.rdata..Y....0....... ..............@..@.data...`....@.......0..............@....rsrc........P.......2..............@..@.reloc.......`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DLM9H.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):47564
                                                                                                                                                                                                                                  Entropy (8bit):6.067450294478503
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B2DE3452DE03674C6CEC68B8C8CE7C78
                                                                                                                                                                                                                                  SHA1:6CAAFF4D8A162BB1080036CE1A6D023AECDA36C3
                                                                                                                                                                                                                                  SHA-256:8F7186A71684DD114E89CC908ED9400192BC3A47FB288CCE4C5C27D0F5D3AFA4
                                                                                                                                                                                                                                  SHA-512:D21C0F9CB1219F14FB53E1B2307F271564F3D24E8E09EAB8B2F2D5799168A40DCFB7866D750140327BD85B21F36FEB7288E7236C9D57CE685087C4B895BC83AF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:fUf..f........fSfVfW.............f..f.........f.^.f.N.f.v.f.~.f.V.f.n...f.....fUfRfWfVfQfSf3.f3.f3.f3.f3.f3...f..&..f_f^f[..f]...............U..VWS.N......S.^..'.G.X.g..G..O..w..W.....w.[_^].U..V...N..n..v.....^]..S........f.EISA&f;.u.........[..U..fVfWfS.v.f...v.f...v.f...v.f.....v.f...v.f...v.f...v.f..f...v.f..f[f_f^].fU..n..fWfVfS..f.^.f.N..~.f. ...f.PAMS..f.^.f.N.f..f-PAMSf..f.N.f[f^f_.f].fU..n..fWfVfS..f.....f.CISG..f..f..^.f....^..N.f....N..v..V.f....V.f[f^f_.f].....VW_^......VW_^......VW....._^......VW.F..V..R...T..R...T..V...X..F..V..Z...\..Z...\..^...`......_^......VW.^...`.9V.s..4.v....9F.w..'..Z...\..F..V.RP.v.....=..t...........k.....V...X..%...F..V...X.%......F..F..V...V...X..F..V.).^...`..F..=..u.....F..V.Pj..v..v........F..V...._^......VW.F..V.).V...X..F..V...^...`._^.....VW.d....f....t....v....h....j....F....F....F....F....F....n....p....F....F....F....F....F....F....F....F....F....F....F....v..v..v..v..G........F..V..^.%....p..F..V.%.......n.....F

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DNJ0U.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):131592
                                                                                                                                                                                                                                  Entropy (8bit):6.421917079260423
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:88D8ED03294B532A48D6B8FB66D4104E
                                                                                                                                                                                                                                  SHA1:F23D8743CD610364836CF21F8D014118BBD067F2
                                                                                                                                                                                                                                  SHA-256:06CA372FB7C01F74B1FF4441535AE7495BAC7D026DBA39EAF9E6735E746D1A29
                                                                                                                                                                                                                                  SHA-512:47F105208F487506F8514FDCFB0CB77FFCF297415F6104319D87863E484F3D12FC58035F44E51A0AD2C0829F4D5D68B71BDC476135442E52F6794A4771B9F2A8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a=b.%\..%\..%\..,$...\..,$..7\..,$..I\..,$.."\..%\..@\..,$.."\..,$..$\..;...$\..,$..$\..Rich%\..........PE..L......e...........!.....R..........)........p............................... ......,.....@.................................\...P........................*......<....q..............................X...@............p..l............................text...#P.......R.................. ..`.rdata..!I...p...J...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-DU13M.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):31240
                                                                                                                                                                                                                                  Entropy (8bit):6.646823092043254
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1F949D8AA38D85C4968DCA9A75DC147F
                                                                                                                                                                                                                                  SHA1:6D3843336EC92409734AABD0012ABDCA907C9A21
                                                                                                                                                                                                                                  SHA-256:7348EBCF8B44EC5653D9608F793E30D40474BD88AB447A12570B7ABAF9377731
                                                                                                                                                                                                                                  SHA-512:41738AAC68852BB46CDF02C34AC2C8BB0CA1D50F4C4869A31C3612E1180B655AC753BDAF9939BF9AEDB8B4C612DB9AA4C8BC0B580061FE546EE9FAED5585CA60
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............`..`..`......`.....`.....`.....`.....`..a...`.....`.....`.....`.....`.Rich..`.........PE..L......e...........!....."...*.......'.......@............................................@..........................V..U....O..P....p..t............P...*...........B...............................I..@............@..X............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......>..............@....rsrc...t....p.......@..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-E1SDT.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):82952
                                                                                                                                                                                                                                  Entropy (8bit):6.464771783953034
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:19005CD96E8372667A8D9EE9835B090E
                                                                                                                                                                                                                                  SHA1:3164BB2656E1751EF8FF1AB5D34659CA7AD413FB
                                                                                                                                                                                                                                  SHA-256:92A3EA9D3336D7C50E438CD7DD232B6B99ECC128CF982FEC17169C9711D9E07C
                                                                                                                                                                                                                                  SHA-512:6750C0263E1E1F11A33D4AA562B2CC22A51E6B465BB978FD2E6CDD98E0FEC1ED08272B632BAF376B17DC746CC728044985F6C53609E44251E484967875DB6F01
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}..o9.<9.<9.<...<;.<0..<8.<0..<<.<0..<).<0..<6.<9.<W.<0..<3.<0..<8.<0..<8.<Rich9.<................PE..L...z..e...........!.........J......}........................................P............@.............................l............0...................*...@......................................@...@............................................text............................... ..`.rdata...3.......4..................@..@.data...X.... ......................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-EPVIJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):76296
                                                                                                                                                                                                                                  Entropy (8bit):6.464621508805773
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B815CE5A7928A6948E27A30E07D91AB6
                                                                                                                                                                                                                                  SHA1:E14C3C0281B0C3A25535784BC00C9D3CF86BA3CA
                                                                                                                                                                                                                                  SHA-256:0DAEDF176E409141392CE196A14B73B716809F4FDEA19A6A09F73DEA9822761C
                                                                                                                                                                                                                                  SHA-512:6F7530E155C8D66F5F41969D42DA6F5F97D31FC5ABB6EB7AE61F42AAC5DF18F291D53ED71C88B2EBF0893459FA8842C0D4E29EEB9CB5296283DF178EE5457C22
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.................).......*.......<.......;.......,.........c.....5.......-.............Rich....................PE..L...v..e...........!.........D......K........................................0............@.........................@...j.......x........................*... .. .......................................@............................................text...k........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc...............................@..@.reloc..f.... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-F75KB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):175624
                                                                                                                                                                                                                                  Entropy (8bit):6.693565340089397
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FA6C64237767708324D598B965391D15
                                                                                                                                                                                                                                  SHA1:1141B9D6F61B363B27F9D8C34CF867A6923E6D05
                                                                                                                                                                                                                                  SHA-256:357B8E085CAC3813508A8506C57B2F36EA191AFE575F4D256ABD91E55AE2D0D3
                                                                                                                                                                                                                                  SHA-512:05FEA66765B834B9BB9E7F3125EF39EAED8855E6005576CA81CA284ABFD6203EABF82C0FFED7478CB252055913CFCCE41993D23F83D8FE6496084EA4BBC3237B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........G...G...G.....o.E...N.l.B...N.z.I...N.}.B...N.j.L...G.......N.s.W...N.k.F...N.h.F...RichG...........PE..L...1..e...........!.....^...".......[.......p............................................@.....................................x........................*..........pq..............................X|..@............p..\............................text....\.......^.................. ..`.rdata..i1...p...2...b..............@..@.data...D...........................@....rsrc................l..............@..@.reloc...............p..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-FL1SA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):417
                                                                                                                                                                                                                                  Entropy (8bit):4.916288788781708
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:624E21D412FE9B592FE955126312C589
                                                                                                                                                                                                                                  SHA1:65408B8A2E208C71DD46F0DCEC56B66831A1D22B
                                                                                                                                                                                                                                  SHA-256:C1754566644D1105A6461B390C165436A1A22265C42D8479554226290215FEA9
                                                                                                                                                                                                                                  SHA-512:165C0CC36F4831A5F654D163E95101113DDFA9BB111A231FAC087883D961EB596389847DDF811EDAFAA1D159329C275DD4BB1787BDFD5E68E4B0F56623DD363F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>.. </requestedPrivileges>.. </security>.. </trustInfo>..</assembly>

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-FTF07.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):50696
                                                                                                                                                                                                                                  Entropy (8bit):6.543255394995795
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:57CCC0EBBE9FE870BE3D673071EDE113
                                                                                                                                                                                                                                  SHA1:1965864146D05C3EA7DB2CE7F731C9FA885D19CA
                                                                                                                                                                                                                                  SHA-256:65655E6CD98FC7FCA16E3564F47CDC1362DB87C380DCBB82CDB34D73938C9C58
                                                                                                                                                                                                                                  SHA-512:5B1A90E20AF2A2ECD94A6DED302F4E9F2D361D3EE44C9807C406FEAA521C84853406DDDBE56DFF970C4D49DB2CD03B54929267E6D42C18A937BA941FE77339D7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p'.i4F.:4F.:4F.:..<:5F.:=>?:5F.:=>)::F.:=>9:?F.:4F.:JF.:=>.:=F.:=> :>F.:=>8:5F.:*.>:5F.:=>;:5F.:Rich4F.:........PE..L...v..e...........!.....^...:......._.......p......................................b.....@.........................@.......x...d........................*...........q...............................v..@............p..<............................text....].......^.................. ..`.rdata..4....p... ...b..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-G3MCU.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):174600
                                                                                                                                                                                                                                  Entropy (8bit):6.6535873330530775
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B3B8848281DC60862DA9A65048F6B5A7
                                                                                                                                                                                                                                  SHA1:5F3B7161A1221F93BDF67AC883F91B5EA43B9E08
                                                                                                                                                                                                                                  SHA-256:67CFB86A0FE94F961131D82EC1D1915919A741FA12FC26827FD4E3AF6A3C25E9
                                                                                                                                                                                                                                  SHA-512:AB6C52E654A447920181D8AF55BF86EF52BD6E36630FEE2068FA7C0B0DD9C508602A11AAE7F40B003EC0A58A2C52B71A0A9DE60F680C5FEC09F39D1045B29A98
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.....@...@...@......@......@....D.@......@...A.w.@......@......@......@......@.Rich..@.................PE..L......e...........!................................................................bE....@..........................M......lB...........................*..........................................`#..@............................................text...G........................... ..`.rdata...].......^..................@..@.data....!...P.......B..............@....rsrc................V..............@..@.reloc...".......$...\..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-G4SG4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):95240
                                                                                                                                                                                                                                  Entropy (8bit):6.412562145085708
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:08866BFB1EBA36E294501A1B10851C4E
                                                                                                                                                                                                                                  SHA1:AC8BC1B54EFFEBDDAE43308B5504295A850CD8C2
                                                                                                                                                                                                                                  SHA-256:0EA63D3B6A7D180981B69ED5866FACF8AD9E3D94FEE000C1DD764996D71DB778
                                                                                                                                                                                                                                  SHA-512:C3A66EAACFC9A3DE17B89E458B84240232BDE15779DCB97418C5D5D8DC54DCD00E61F836E3CC31E8C76B21567559BD12DB2138A5AC51E78C450B44EED6371EE2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..............^.......].......K.......L.......[.........f.....B.......Z.......Y.....Rich............PE..L...9..e...........!.................................................................*....@.............................G...|...P....P...............J...*...`......................................0...@...............l............................text............................... ..`.rdata..7H.......J..................@..@.data....+... ..."..................@....rsrc........P.......&..............@..@.reloc..J....`... ...*..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-G5DVO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):6962
                                                                                                                                                                                                                                  Entropy (8bit):4.961979340689982
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:221652D34CB9B7BEE0B5ECBBD1089546
                                                                                                                                                                                                                                  SHA1:D25B9498830507E24F72C7BCE07FBB3EB2A3AF0A
                                                                                                                                                                                                                                  SHA-256:A5D6AAAA12E3AC9E2AF9ADEFF3983923F58665168613964822150F3BA0800D82
                                                                                                                                                                                                                                  SHA-512:7AA66B63164AF314F9F6FB86D0FBEF7A049A5C3629A4391EE6E4EAAE3C8397FBF6596057AF7B063413A8903F66880CD9A885F10A31AD3A8D5662430BCB3ABDE3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<EASEUS>.. <GROUP default="Yes" name="Music" icon="../res/Music.png"> .. <EXTEND default="Yes" name="AAC" icon="../res/iconView/AAC.png" comment=""/>.. <EXTEND default="Yes" name="AC3" icon="../res/iconView/AC3.png" comment=""/>.. <EXTEND default="Yes" name="M4A" icon="../res/iconView/M4A.png" comment=""/>.. <EXTEND default="Yes" name="AMR" icon="../res/iconView/AMR.png" comment=""/>.. <EXTEND default="Yes" name="FLAC" icon="../res/iconView/FLAC.png" comment=""/>.. <EXTEND default="Yes" name="APE" icon="../res/iconView/APE.png" comment=""/>.. <EXTEND default="Yes" name="MP3" icon="../res/iconView/MP3.png" comment=""/>.. <EXTEND default="Yes" name="WMA" icon="../res/iconView/WMA.png" comment=""/>.. <EXTEND default="Yes" name="OGG" icon="../res/iconView/OGG.png" comment=""/>.. <EXTEND default="Yes" name="OGA" icon="../res/iconView/OGA.png" comment=""/>.. <EXTEND default="Yes" name="WAV" icon="../res/iconView/WAV.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GACLS.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):25096
                                                                                                                                                                                                                                  Entropy (8bit):6.818738303246133
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7A65A83BEFA4F6FF5D1C7237E7C240CB
                                                                                                                                                                                                                                  SHA1:8431D8631A4509D80589B3E7279B9E612D07FE36
                                                                                                                                                                                                                                  SHA-256:154DF8AE37D09DBECEA9A82DC145A85DD631AF9B4D6C87E4362D57719C5CDBED
                                                                                                                                                                                                                                  SHA-512:CB9A50465E59E0A9A6275F3148D790637447DB2E8E8994503FBA51200A2CD3D60B14E8276061C94BD08B0C540EB043D4C69D1D57F14993535A31ACBEEC2C6B75
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b....V...V...V?..V...V...V...V...V...V...V...V...V...V...V...V...V...V...V...V...V...VRich...V................PE..L..."..e...........!.........................0.......................................:....@..........................B..X....;..P....`...............8...*...p..P... 1...............................9..@............0...............................text...o........................... ..`.rdata.......0......................@..@.data........P......................@....rsrc........`.......0..............@..@.reloc.......p.......4..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GCQG2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):303112
                                                                                                                                                                                                                                  Entropy (8bit):6.1407992758048024
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0E93FF1EAB671D2820BFC3C068A8AA99
                                                                                                                                                                                                                                  SHA1:683FEBE21E62E9C4AEF48F2188A714EBC79FD841
                                                                                                                                                                                                                                  SHA-256:66F9BFB75215EA1A87CB8CF7BC980BF8ABB4C64BC6B5863433ACF35A25DC3078
                                                                                                                                                                                                                                  SHA-512:42ADD48D0D274B88F7DEE43A737DC2F979AA1624903A167C3ADE6C3901789820BBCD0C8E904A6BD1F59D9274BF5F0F56FA9CB99F86370840D07F11A8EDF4D23C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."sy.f...f...f....]..g...oj..d...oj..h...oj..o...oj..m...f.......oj..h...oj..g...x@..g...oj..g...Richf...........................PE..L......e...........!.....B...0......~8.......`............................................@.........................0d.......O..x....................v...*......x...Pb...............................0..@............`..(............................text....A.......B.................. ..`.rdata.......`.......F..............@..@.data...$....p.......L..............@....rsrc................R..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GJAP3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1162744
                                                                                                                                                                                                                                  Entropy (8bit):6.531289155070338
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B9030D821E099C79DE1C9125B790E2DA
                                                                                                                                                                                                                                  SHA1:79189E6F7887CA8F41FB17603BD9C2D46180EFCF
                                                                                                                                                                                                                                  SHA-256:E30AABB518361FBEAF8068FFC786845EE84ABBF1F71AE7D2733A11286531595A
                                                                                                                                                                                                                                  SHA-512:2E1EBCBE595C5A1FE09F5933D4BA190081EF343EA313725BB0F8FCBF98079A091AB8C0465EF437B310A1753FFC2D48D9D70EC80D773E7919A6485EF730E93EA1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...~H.X......X...~H..I...G.>.[.....;.X...G.8.R...G...F...G.).P...~H.P...Y...;...G.'.....G.?.X...G.9.X...G.<.X...RichY...........................PE..L...*`1G...........!.....j...P......a@.............x.................................x....@.........................P....g......x........................#......h.......................................@...............<............................text...kh.......j.................. ..`.data....l.......J...n..............@....rsrc...............................@..@.reloc...1.......2...h..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GJCK2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):73736
                                                                                                                                                                                                                                  Entropy (8bit):6.841745406976826
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8643B92297BE585A1A4B74B84A1ABD32
                                                                                                                                                                                                                                  SHA1:DA1862CA3C196C75E6A587CE45AB63A6B1FE3B11
                                                                                                                                                                                                                                  SHA-256:39C76B2183916A5CD483E520F1519B965C3B03760D4F8ECD8BF3E3D1A22A4F1C
                                                                                                                                                                                                                                  SHA-512:07A635B28A9EB58C4FBCB5F0F6E6B7F3C6F9ACFBA577650D46885E8C5F10E283E25BFDF97F6DB5C6B73AE7BF51136F7570D086DCA6A5140605BCBFAA1E469386
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.m.9...9...9.....;...0..?...0..7...0..=...0..>...9...z...0..=...0..8...0..8...Rich9...................PE..L......e...........!.........d......d........................................0............@.............................i.......P........................*... ..`...0...................................@............................................text...?........................... ..`.rdata...6.......8..................@..@.data...l#....... ..................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GKICP.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):224768
                                                                                                                                                                                                                                  Entropy (8bit):6.040336415310379
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4A8BC195ABDC93F0DB5DAB7F5093C52F
                                                                                                                                                                                                                                  SHA1:B55A206FC91ECC3ADEDA65D286522AA69F04AC88
                                                                                                                                                                                                                                  SHA-256:B371AF3CE6CB5D0B411919A188D5274DF74D5EE49F6DD7B1CCB5A31466121A18
                                                                                                                                                                                                                                  SHA-512:197C12825EFA2747AFD10FAFE3E198C1156ED20D75BAD07984CAA83447D0C7D498EF67CEE11004232CA5D4DBBB9AE9D43BFD073002D3D0D8385476876EF48A94
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...`...`...`..{`...`..~`...`..}`...`.@.`...`.j.`...`...`<..`..k`...`..l`..`..z`...`..|`...`..y`...`Rich...`........PE..L....=1G...........!.....:...................P....?x.........................0.......L....@..........................1..4....%..d...............................d...P...............................P...@...............(...........p...H............text....8.......:.................. ..`.data...|....P.......>..............@....rsrc................H..............@..@.reloc...!......."...L..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GKIDG.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.1621906440192165
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A9B1331617F9913210D4DFDE195D6929
                                                                                                                                                                                                                                  SHA1:6587BF0B9B89F212EE0E211CA55BBCE376FA7841
                                                                                                                                                                                                                                  SHA-256:EFB33877982C3D8001CF752B50BFD1E422327C274BDD1C843D762F629307F95A
                                                                                                                                                                                                                                  SHA-512:EAFE8157C510073349CFDDECEF6A713235B21A2C5F804A0E05F8CC2D1F1C82D9325C02C395448E029E5836DF72AA62C9026E93E9B5057A615A94EB0F95FF7A00
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...=/oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text...m........................... ..`.rsrc........ ......................@..@....=/oX........8...8...8.......=/oX........d...p...p...RSDS.....E..-~..H%....api-ms-win-core-file-l2-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................oX....v...................4...`...................@...z...............+...W...................,...]...................J.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.CreateDirectoryExW.k

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GNT1D.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS executable (COM)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):257200
                                                                                                                                                                                                                                  Entropy (8bit):6.606122270621862
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:418B54CAD38B9EA48A8DA2774E15959F
                                                                                                                                                                                                                                  SHA1:E73CBCF2B27E0A62221E36EFDA7A8E3A8925EE13
                                                                                                                                                                                                                                  SHA-256:7F27C6A7BC77387055D46EAF7A7ED53FC18FC64F6576C1FB4D3338DAF622F120
                                                                                                                                                                                                                                  SHA-512:E572589B81A8E53ECBC24E8F6A64AD72402978FB77ABD86BAD004C016A64DF5401DBE3486BE102CFECAFF77758F306F3AC3B0B5B5B7035178CBE0DB4B7F921FC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.........R....f3....4..Q......Pf..T.f...f..f............X.0..........Z.....RQ.fS.D...f[..........YZB..J...fSfSP....:.f..Xf....f[.......3......P..f;........f...f..f..X.(..f[.fPfRfQfS.f..L.f..f.M....]..f[fYfZfX.PfQ3..$.A.......@;.....fXfPf;..........fYX.P&g....>.......$........fCfC.................f.............X.fQf.....>.......f..f..f....f..f...f3.f..fY.fPfSfQf..L.......f.L.f..\.f..D.f..f+.f..D.f...f...f..fHf3.f..f+.f..D.f+.f..f..L.f3.f..2.f=..........fYf[fX.B..0/........(.R...f...f...f.....f....3.f...f.........fh....f...W.3....j0..............l..D.h..h..D.h.. .......f......"......f...."......jXhm..`....3...........(.........WV...~.&..-..s.&.....R..=...r.&.E....B..... ..WP&.E.&.].&.M.&.U.&.u.&.E.._..&.E.&.E.&.].&.M.&.U.&.u.&.E...^_................................................................f.v.f.~.f.N.f...........gf.f.N.f....g..........f.~.f.N.f........f3...gf.f.N.f....g......................6...`........ .f%....."....... ....."..... X...l..D....h..D......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GUIII.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1618440
                                                                                                                                                                                                                                  Entropy (8bit):6.759157601961033
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:055E9B99F0321F89ED21E779E717AEE1
                                                                                                                                                                                                                                  SHA1:CD2C8F201F320F616A956D6334D58A6288A14482
                                                                                                                                                                                                                                  SHA-256:D3C09FC693DC795E3BB2C019BA093463EEA08CCA5A9329FA229DF32E095DCEE6
                                                                                                                                                                                                                                  SHA-512:06FBC30BE53D84015838942C893C5B4C2B82495BB4A0BE8100D899E20CF93602B32E70B149DFB42FCDBAABA8DEA3608FBAF4CE5712CF9515334AD669A9DE972B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U5X.4[..4[..4[.[{...4[..L...4[..L...4[..L...4[..4Z..5[..L...6[..L...4[..L...4[..f...4[..L...4[.Rich.4[.........PE..L...+..e...........!.................a.......0............................................@......................... ...z................................*.......... 6..............................h...@............0...............................text............................... ..`.rdata.......0......."..............@..@.data....... ......................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-GV94K.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):123400
                                                                                                                                                                                                                                  Entropy (8bit):6.438598962431677
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:56A50D3314437A90B18936332F0A6922
                                                                                                                                                                                                                                  SHA1:EC287B6226AD2B79C069916E58218D424A2020F3
                                                                                                                                                                                                                                  SHA-256:2BCCC8D137B75D869B0C2C60C846962A1D1F613B098736D823E131DD18F3F9B3
                                                                                                                                                                                                                                  SHA-512:DC2E8A083985FBAAFE06645853735C9BFBA60B3F1A5FA35F5915E45F1D91BF0D28BB190AA8C8019A62936D0600D33ED2C57328B27D958EC7454F13F7BB8266C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c`]............dM.......z.......z.......z.......z...............z.......z.......z......Rich............PE..L......e...........!.....l...H......Ld...............................................1....@.........................@...v.......x........................*.........................................h...@............................................text...0j.......l.................. ..`.rdata...5.......6...p..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-H564L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):121352
                                                                                                                                                                                                                                  Entropy (8bit):6.412617735839581
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5D2B193CC78C786B9C678F7DE6E6C491
                                                                                                                                                                                                                                  SHA1:B895179BA596C752541E684CC0D568B47817D0C6
                                                                                                                                                                                                                                  SHA-256:EF4DB6DA7A1B6238C6BF502C9E9BCCF4E45BCB98ABEFEFE790471435C3EE7D30
                                                                                                                                                                                                                                  SHA-512:8EC789F806BE73E0C3C650FCD621B15CA8B59F2FBE6D73EC6DEFF44D6FB310E4C8D6EBE6B2742D2361F0E826787EFF9B5E43A853DD8777839C75E344BA1BFC22
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uK@.1*..1*..1*..8R..#*..8R..\*..8R...*..8R..>*..1*/.L*..8R.. *..8R..0*..Rich1*..................PE..L......e.................8...t..............P....@.................................)%....@................................. ............................*...........Q...............................z..@............P...............................text...G7.......8.................. ..`.rdata..LC...P...D...<..............@..@.data....-..........................@....rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-H9EE9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):58888
                                                                                                                                                                                                                                  Entropy (8bit):6.62271781423729
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FB1B129F09AE255837E2DFAE56EC393E
                                                                                                                                                                                                                                  SHA1:AFB7554748173BE8FAE4E76EAED16559202718FD
                                                                                                                                                                                                                                  SHA-256:052F5CD8EEF61D00CF53FB0C112721419BD2F61ADA6CE86982A515B98C1F5AB4
                                                                                                                                                                                                                                  SHA-512:491160890CD05D0B41BA759E63D0A7E3DDD4829FB5E5F796B9BAD07A2B257D5D11216F8E73AAC10E17C9D8C128AB707763558304F84C66B0675FB57EB85FDAA3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.._.._.._...K.._..'H.._..'^.._..'Y.._..'N.._.._.#_..'W.._..'O.._..'L.._.Rich._.................PE..L......e.................p...H.......n............@.......................................@.............................e...P...x........................*..........0...............................@...@............................................text....n.......p.................. ..`.rdata...2.......4...t..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-HJRN2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):82440
                                                                                                                                                                                                                                  Entropy (8bit):6.1253584710814275
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:59A598B8B462A432192ACCB1B78FEE02
                                                                                                                                                                                                                                  SHA1:47566F346CA0FE31846E0456A07444E529E2BE22
                                                                                                                                                                                                                                  SHA-256:A196164B0B5660E871EE8053641B17E348858C376F30E4450A4BB532FFA7EEA3
                                                                                                                                                                                                                                  SHA-512:AB8D78373DE8D777A14FC7EDE2DB38BBCA40C9E2C1AF535DDF89F0E8748ACEABFD27C90C9CABEE9A3E3594A686714EE65D565EB96571A9E34F8E9153935DF419
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................}. ......#......5......2......%........l.....<......$.......'.....Rich....................PE..L...Z..e...........!........................................................`............@.........................P...........P....0...................*...@......................................8...@............................................text............................... ..`.rdata...d.......f..................@..@.data...............................@....rsrc........0......................@..@.reloc..X....@......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-HLF99.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):17600
                                                                                                                                                                                                                                  Entropy (8bit):7.192918645714175
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5C5D8D4E26159DB2D0210E1B96B19387
                                                                                                                                                                                                                                  SHA1:C90060E6F97B25776D6501C33519D1DB414F3CD1
                                                                                                                                                                                                                                  SHA-256:77DCBC49D395DE32D0C7D5185D72E5EB80EAB63B3748F9E7232A6313DCA238F9
                                                                                                                                                                                                                                  SHA-512:91774F40708E110892AFF99EEC193E2450560323193E1ADE7DC12BC633939766C3FC76DBFC46C2FEF382B787C96590E998C4DE1E6318E865DE0AEE4C858E0534
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......AM....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........>...8...8.......^*oX........d...x...x...RSDS..V....C.;...#.\....api-ms-win-core-rtlsupport-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX....&....................... ...^...........L...v.............api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-I936D.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2937328
                                                                                                                                                                                                                                  Entropy (8bit):6.526679153933017
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7FF6836C626BBC7F0833A66AA77A7A7F
                                                                                                                                                                                                                                  SHA1:9AD21C1A5DF940999BA9F884D21868D3B69E7155
                                                                                                                                                                                                                                  SHA-256:8CFC024D09A6784486DA7DC0EBFD90C0C8136B27C08EC1C3F352CD4FA43B9273
                                                                                                                                                                                                                                  SHA-512:8FF378B9D2A1058396FF5E9795F7BD25FC3092F94B9274447C849C19294569197F6920BDA448A3E2C06B012BA1468D75F2B26ED1BD4E54191F28CA209BF41697
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M6M.#eM.#eM.#eD..e].#e..'dG.#e.. dD.#e..&dV.#e.."dI.#eY."dJ.#eM."eO.#e.&dC.#e.#dL.#e..eL.#eM.eL.#e.!dL.#eRichM.#e................PE..L....._...........!......"..&......}. ......."...............................,.....;a-...@...........................*..\...l*......0+.P.............,......@+.t....'.T....................'..... .'.@............."..............................text....."......."................. ..`.rdata........".......".............@..@.data.........*......|*.............@....rsrc...P....0+.......+.............@..@.reloc..t....@+.......+.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IF66L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):21512
                                                                                                                                                                                                                                  Entropy (8bit):6.865372809241953
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AFC3CE4B97EF7B35ACCCCAB6DA35114D
                                                                                                                                                                                                                                  SHA1:A6C00930F071BF1F5AF622F47DD2094FAD9D52EE
                                                                                                                                                                                                                                  SHA-256:A65283FA59F9E9813339C853D03C6C83BB4418CA55C221DAB926173A51AEBF71
                                                                                                                                                                                                                                  SHA-512:67E7DC5FD7E6BCFFBD5DA7BC1DED4B00985F7291F15417170BBCF5A078EF45F2500100C37020B194D05C5D1FF38DF5EB4487CDC6B4D744FADA9A70903C9455F0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.q..."..."..."dJl"...".}o"...".}y"...".}~"...".}i"..."..."...".}p"...".}h"...".}k"..."Rich..."........................PE..L......e...........!................{........ ...............................`............@......................... +..N....&..<....@...............*...*...P....... ...............................$..@............ ...............................text...p........................... ..`.rdata..n.... ......................@..@.data........0....... ..............@....rsrc........@......."..............@..@.reloc..@....P.......&..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IFM27.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):20160
                                                                                                                                                                                                                                  Entropy (8bit):7.082451608232979
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2AB82A2368023085FFB3E2C4DF1483D3
                                                                                                                                                                                                                                  SHA1:5C7204631683653644771354B4282C63C994DAD8
                                                                                                                                                                                                                                  SHA-256:9480BB7257C40483E6CB6433CDD90871D55912BDBCFB87F33C11D7401F50F94A
                                                                                                                                                                                                                                  SHA-512:96F1AE8252D353297517B9459A359FC617D1065AAFEFA1532DF44CB7781A2C16D5E1429FAD3330EFDDD874A0B00592146B2582CD9D9D918BBEDF97823D4825A2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......G....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........=...8...8.......^*oX........d...x...x...RSDS.......C..9........api-ms-win-crt-filesystem-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX............A...A...............................&...A...b.......................A...e...........................?...]...|.......................(...F...b...~.......................%...B...^...w...................5...[.......................)...C...^...x...

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IGCVJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):129544
                                                                                                                                                                                                                                  Entropy (8bit):6.501885491915777
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:63B7145C16F95EBDCEC202F67B1C0B4A
                                                                                                                                                                                                                                  SHA1:ED178F7EBF85B6834842922E5F932EFF8440F1E6
                                                                                                                                                                                                                                  SHA-256:9E9A2C33CC5A941FD4D92A98A58516CB6C0A5AD4D08DC7572A2D391F8A9B048D
                                                                                                                                                                                                                                  SHA-512:2388D519BA57CEC709B70883E62A4E2E3FB5396A6EC42E7980E582F3454BB1E3A4DF62C5A3D200A00CF9A6F7BE757C8EB2236D690EB1C935ACB4E9038232A710
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..}...}...}..\2...}.......}.......}.......}.......}...}..(}.......}.......}.../...}.......}..Rich.}..........PE..L......e...........!.....F...........7.......`...........................................@.................................t............................*..........@c..................................@............`...............................text...@E.......F.................. ..`.rdata..M\...`...^...J..............@..@.data...............................@....rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IIMH3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):19136
                                                                                                                                                                                                                                  Entropy (8bit):7.072310267433324
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1C1396B44717F5BE5DCD06DEE6B49029
                                                                                                                                                                                                                                  SHA1:A1D149163E64CD4C9CB5124187DD8B4219279BD4
                                                                                                                                                                                                                                  SHA-256:851031C6DD624B3AFF9A0BC125F07D7ADA35DBD9D189934CB0641C663B69202C
                                                                                                                                                                                                                                  SHA-512:C0D3BB9B9A4274703B4697E4F92CC297BF2365E09768A42703AE8CA4C241FFE2E0ED70967FA5CE34320C8634BE31B4EED267582B8576C05D7F1C3E9DFE5FA350
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.............................G............ ...................<..............8............................................................................text...7........................... ..`.rsrc........ ......................@..@....^*oX........F...8...8.......^*oX........d...........RSDSX.n/c.%D.....C.}....api-ms-win-core-processenvironment-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02......................oX........................l.......2...o...............=...k...............@...y...............&...[.......................U...............-...V...............(...a...................D...{.......................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IMFS9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):163848
                                                                                                                                                                                                                                  Entropy (8bit):6.400693548425772
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8A808959EB9E2E17A7AFC6F6ECFD6FAB
                                                                                                                                                                                                                                  SHA1:45A6F16F503B2C50C85F7992AE45BAFF6A9F36A3
                                                                                                                                                                                                                                  SHA-256:D76BB71E492F9C33D606A38CED889668B56EFC60E03B52E1EAA8A592FA39433F
                                                                                                                                                                                                                                  SHA-512:AC1DB8EBC33973CEBCAC0939E70EFE8298FC7D8F34671D8A3B7F728B6A9D079F83E5EDE3498A33C461BAA8BD9F01C47ACE819C1947D80AD6BD19755CC578CDB0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R~.j...9...9...9Dw.8...9Dw.8...9.v.8...9Dw.8...9Dw.8...9.gD9...9...9...9.v.8...9.v.8...9.v(9...9.v.8...9Rich...9........PE..L....<.d...........!.................................................................,....@.........................p!..X....!.......p...............V...*..............p........................... ...@...............8............................text...)........................... ..`.rdata..~k.......l..................@..@.data...(....P.......8..............@....rsrc........p.......D..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IOAPV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):55816
                                                                                                                                                                                                                                  Entropy (8bit):6.601517399358801
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:95C7087A4F16E94474C69ECB70642456
                                                                                                                                                                                                                                  SHA1:CA066C0CF8AE717AF9232DED7F69DFDE0851D1E7
                                                                                                                                                                                                                                  SHA-256:C2624B0B4D86CCEBEF4BB7AC47706D02D5F65C0399C84122FDFB1262A09658C6
                                                                                                                                                                                                                                  SHA-512:9BCF6F5D252A925A4BC63F2DCD956246D85B2264CAD4C70014DC8BCC35CE397B0A90485C4DD96973B6ED18D4D477AE6974A683072C356AAAC22842CB7A03A80F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...J...J...J.".....J.......J.......J.......J.......J...K...J.......J.......J.......J.Rich..J.........PE..L......e...........!.....R...Z.......W.......p......................................:.....@.........................0...........P........................*...........q.............................. v..@............p...............................text....Q.......R.................. ..`.rdata...'...p...(...V..............@..@.data....'...........~..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-IT7DH.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):892928
                                                                                                                                                                                                                                  Entropy (8bit):7.316650828024265
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D7CBBEDFAD7AD68E12BF6FFCC01C3080
                                                                                                                                                                                                                                  SHA1:A21C860B81ED158E91B2B921B752F48FDA6D6F1E
                                                                                                                                                                                                                                  SHA-256:AA9EC502E20B927D236E19036B40A5DA5DDD4AE030553A6608F821BECD646EFB
                                                                                                                                                                                                                                  SHA-512:739A2913F882B712A4D20F831530A411081644704B9AE234F4623B4FB2400F6A36486454F6A25DC8676EF5C570D3E23698B9A35BB3C2712DDB7E050661F36924
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z...;...;...;...$...;..H'...;...$...;...$...;...;...;.......;...=...;..4....;..Rich.;..........PE..L......@...........!.................................................................................................Y......DX..<....p..........................,.......................................................D............................text...z........................... ..`.rdata...z..........................@..@.data...|....`.......`..............@....rsrc........p.......p..............@..@.reloc..<........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ITCPB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2354
                                                                                                                                                                                                                                  Entropy (8bit):5.358221233322532
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:17683BDA76942B55361049B226324BE9
                                                                                                                                                                                                                                  SHA1:594CE635A06029B7206CB8AC7D68883B122A07F9
                                                                                                                                                                                                                                  SHA-256:27C573D1DE24A2CEF2B2CAC0850BF079A02D478D54CF00617A1D2F08A17109F5
                                                                                                                                                                                                                                  SHA-512:5C0F1D2A0C054A3E26D579963A044DC1B32CBE307C54ACF167EEC194D3DE2525823570564844971B7764A7EF93C60956E4CE17D76A720EF3C6A114A17137180B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="f29de3b0fa14e6ff8c70e48921de5ad3cb433997"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>b027Nqjn5ZThKiqe1Lca8PqnYsE=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="0e22737c69b9bbee766f0c92263e2ccf8c82c72d"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="h

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J19EC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):519176
                                                                                                                                                                                                                                  Entropy (8bit):6.14565422287424
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:695A330355C213C5DE06090E4F0F3160
                                                                                                                                                                                                                                  SHA1:DF369E905C14C24AAF30AA3FE4FB86DB738A1DC8
                                                                                                                                                                                                                                  SHA-256:2C6ECD541747C868CBC485A5F67615148263790E00D5508D897BA2E84721F889
                                                                                                                                                                                                                                  SHA-512:671CB2E3B6E854C6746AD95297D0B51C0A60B3DCBDB5B89BFA808CA2C4F3F1EF91ABFF2F0CCE6BBA3B03D3CE51DC7EFC8BD55FA0A04F3E3988BEC42FBEDE434A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h,Z...Z...Z......[...S..R...S..T...S..Q...Z.......S..Q...S..I...S..[...S..[...RichZ...........PE..L......e...........!.....r...L......`8...............................................(....@..........................|..y....R..x........................*.......2......................................@............................................text...:q.......r.................. ..`.rdata..i............v..............@..@.data................f..............@....rsrc................|..............@..@.reloc..&@.......B..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J6DTU.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):81928
                                                                                                                                                                                                                                  Entropy (8bit):6.3761683559675015
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:211B9E08E27067F13CE4A00341936477
                                                                                                                                                                                                                                  SHA1:B7EC515BCC71448E8DF6A5F51F73E5D87C97498A
                                                                                                                                                                                                                                  SHA-256:ABA9A5B591A7100B002BBE69700304FA05BD930F9A83F8A47AD61277C51F207D
                                                                                                                                                                                                                                  SHA-512:7495D22D17EFDBA3DD84BF69FB1D444113DC337CDCDB60A892F8F7CF778D7AAE4C0F2DBAE136764B91CF6C2087BD7E266C4EEF08F13800B6D86ECCCB9362AE51
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k...._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._Rich..._........................PE..L...B..e...........!.........................................................@.......d....@.........................`...f.......d.... ..<................*...0......`...................................@...............@............................text............................... ..`.rdata...l.......n..................@..@.data...$...........................@....rsrc...<.... ......................@..@.reloc..P....0......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J7OJA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):55304
                                                                                                                                                                                                                                  Entropy (8bit):6.575923690323825
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C454FDE543123A23BC9F61ED42B0711C
                                                                                                                                                                                                                                  SHA1:700CB5C48588EC58D2CA28E6C3177C34E93D36C9
                                                                                                                                                                                                                                  SHA-256:C064E9A5D2478D7603BDCEAF59F0939F4EA0E131F8404B8C6EB9A4EB6DFBC160
                                                                                                                                                                                                                                  SHA-512:996D5AF78287BAC3EBBAEDF93CDA7FE219EB7BE7DCE54401705ACE84E01F579973D831A97C691896E16904900071328D848EEE41DA6126B558AB726E8566A7CB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?/.[{N..{N..{N......zN..r6..yN..r6..tN..r6..}N..r6..pN..{N...N..r6..zN..r6..zN..r6..zN..Rich{N..........................PE..L...8..e...........!.....p...:.......t....................................................@.........................p...........x........................*.............................................@............................................text....n.......p.................. ..`.rdata...(.......*...t..............@..@.data...<...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-J97EA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):161784
                                                                                                                                                                                                                                  Entropy (8bit):6.60365470430968
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:64ECA1F64E4A988A6C5C93F3E5D66236
                                                                                                                                                                                                                                  SHA1:06FD9138C430E7F2D390B9A58EDF5D949F57057F
                                                                                                                                                                                                                                  SHA-256:AB93DF816C284AC247B9087663BC449BEB26E6F64D9F8A6BE2EFECAFA7A9CEDC
                                                                                                                                                                                                                                  SHA-512:9646AF577AA1390747CC58806D5BBA167F21D4E6A05A87DDF200F3E0D64CCC05F2C0155E4DA4EF89B17EEA5FAC748BE9E4D6D074945D0BD07AB2D19E0D5FF3E2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v.92..j2..j2..j.j.j0..j,.gj"..j,.qjG..j.j.j1..j2..j..j,.vj...j,.`j3..j,.fj3..j,.cj3..jRich2..j........PE..L....=1G...........!.........~.......2.............x.....................................@.....................................(....@..."...........T...#...p.......................................[..@...................d........................text............................... ..`.data....0..........................@....rsrc...."...@...$..................@..@.reloc...'...p...(...,..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JE6UF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):59392
                                                                                                                                                                                                                                  Entropy (8bit):4.410706083831758
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EEB0A4CC976A8D732EB1168514C77236
                                                                                                                                                                                                                                  SHA1:FEF206C7750C2CA1F4DF1C74F4868A700F83F747
                                                                                                                                                                                                                                  SHA-256:A7FE95E7FC7420A12A71D9AEE57130ADEFD3AFC3017EB98BCFCB509B2F2AF1BF
                                                                                                                                                                                                                                  SHA-512:F3ED5A509618A3B6ADC62A8032047C5255EE4B4AB42E349B8BF03D903C5D85F8EFD915BE6039D13E7A67099650C2BE480A7AAA57FA8BC8BABDCF5B8D3DAAB2BB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]................................\.....@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JFN3L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):214536
                                                                                                                                                                                                                                  Entropy (8bit):6.707927621197115
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EFF772A2A05016770B049F57F7514977
                                                                                                                                                                                                                                  SHA1:386D118E14738117746228859E8F49E934F3C733
                                                                                                                                                                                                                                  SHA-256:5F0E1D2A0731E730C18A50864D6F838685BEEF845EB83B9514C7C32B414D96CF
                                                                                                                                                                                                                                  SHA-512:E30B491A276C593AE6B4C732B2D4296D7975C6D38AE1838BBEEA63430505E7B42BE79BB1E4F9EC8467E7061014F199B4A02B906142FE57F0E7023BE2CA0AC60D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:G..~&.,~&.,~&.,.ip,|&.,w^s,v&.,w^e,q&.,w^b,v&.,w^u,y&.,~&.,)&.,w^l,a&.,w^t,.&.,w^w,.&.,Rich~&.,........PE..L......e...........!......................................................................@..............................R......P........................*..........p...................................@...............P............................text............................... ..`.rdata..............................@..@.data...Pe...@.......$..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JH069.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):128008
                                                                                                                                                                                                                                  Entropy (8bit):6.696441415639864
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5E934804075F185F75C8E0771D312D5D
                                                                                                                                                                                                                                  SHA1:1C95EF03B3C63CB268434DAEE816CA002633696D
                                                                                                                                                                                                                                  SHA-256:426968882410D78A9FA555D939336E6BA49DC6F0FBDFDE8A15F6E88B9BFD0BCC
                                                                                                                                                                                                                                  SHA-512:F45FFB58FD7ED7B4AD382F5B5EF924BD529EB59DE2B543B701B10B5B7D8B53D0D930E25826073302E1454F3943060923941A5E38D5BFD11E81ADC5E495C744E4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IA...A...A.....u.@...H.v.V...H.`.4...H.g.u...H.p.B...A.......H.i.B...H.q.@...H.r.@...RichA...........................PE..L...H..e...........!.....H...~.......D.......`.......................................+....@.............................i.......(........................*..........pa..................................@............`..8............................text....F.......H.................. ..`.rdata...<...`...>...L..............@..@.data....>.......$..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JH7R3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):523328
                                                                                                                                                                                                                                  Entropy (8bit):6.518180855360331
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6065FB9344E2B050C15485E94D664759
                                                                                                                                                                                                                                  SHA1:E48796C7B4E2D8D8AA9C0F8E3FB0EB9E62C27608
                                                                                                                                                                                                                                  SHA-256:0FF923CF6B8883F79E7F3220270A9CF3E6270AD915680774F3F2D6ED327B0E3B
                                                                                                                                                                                                                                  SHA-512:CFC1C9D69EB162950560D2270142AAAFBA818A092E626D3F7FE1BD33D41F0E2F6957543B522C9F33070AA60EAEAF094FC19B309109A4B242B82123B4C9776DAD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P'#D.FM..FM..FM..>..KFM..>..5FM..>...FM..>...FM..>...FM..>...FM..>...FM.Rich.FM.................PE..L.....[J..........................................@.................................+_..................................4................-..............@............................................................................................text....&.......(.................. ..`PAGER32Cu....@.......,.............. ..`PAGE.....:.......<.................. ..`.rdata..@...........................@..@.data...a...........................@...PAGER32R.....p......................@..@INITDATA............................@...PAGEDATA............................@....rsrc....-..........................@..@........................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JHF5M.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS/MBR boot sector
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):512
                                                                                                                                                                                                                                  Entropy (8bit):5.708891320905848
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BDD732AC156687D64F0307E7696F7992
                                                                                                                                                                                                                                  SHA1:4DD52CED3C90FC33D348A7D403115DFE06343FDA
                                                                                                                                                                                                                                  SHA-256:B6E5F8C464F4A747553C63FC352CB7EF9145C2B232E7E50E3679785D306E94EF
                                                                                                                                                                                                                                  SHA-512:F2A4DD1B21CA618038BC974D10A99F8E3A308013E2CB89FB79CBEA1F6ACD3D60AFAAF70415C8751D9C895C0AB7D21A590C3084DCF918CB434B84706D055324F6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:....xss......+.......|.........h&.........l.......f.....~...........7.a.........f.........rwfW.w..g.....u..7....r.......8.... ..f+.@....f_fGN;.s...+...r.f.......u..h..... S...f...f..@..|....v.r.......U.t?3.......8,|.u........f.|...|........D.r.....=U.u......L...........S.`+.....t.....a.`.....a.`..A..U.....a.`fh....fW.SQh.....B.....gf.d$.a.xssfs TBLD EASEUS Todo Backup Loader....Invalid Todo Backup Loader...........................................................................................U.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JHQ4N.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1396232
                                                                                                                                                                                                                                  Entropy (8bit):6.701997711926755
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8D30DEA5566E8E3E74111A54D71E0767
                                                                                                                                                                                                                                  SHA1:3274E8FEBD7362A1E17E7EAC6D63BF7CA5BD4A9F
                                                                                                                                                                                                                                  SHA-256:DF5243C1C0DA45EF5CC717E1B321094379990415B0E74DFB51199B261514059F
                                                                                                                                                                                                                                  SHA-512:0D2DADD667E487849ACC604172FD85AA5C25D645A2B1AD7F76C1641137C161E04F0FCDF084DE50704384C8C5F8DCA23305F123F105F15F3BFA250F1F67EBA8B4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d...d...d..m+%..d....&..d....7..d.... ..d...d..ud....0..f....9..d....!..d...."..d..Rich.d..........................PE..L......e.............................c.......0....@..................................*....@......................... .......l...d....................$...*......H....2.................................@............0..H............................text...Y........................... ..`.rdata......0......................@..@.data...............................@....rsrc................@..............@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JP89G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS executable (COM)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):216893
                                                                                                                                                                                                                                  Entropy (8bit):6.648250320524843
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AD0F6F809EE71B7AE9EDDE6FF7A3DD34
                                                                                                                                                                                                                                  SHA1:FF0980DC0792819E3E42FDCE7E6E58E98A57569B
                                                                                                                                                                                                                                  SHA-256:DD3E8E8FABBDBBCCBE33FCB89AA319399B77F86844513DE3BC025B570455A871
                                                                                                                                                                                                                                  SHA-512:87364AE2A8A1845730DFF8F942C9990AA329D3EF58BC906189C9311FCD6EB461125AF477F817055732B2E41AA7BCEF2898F6BF223645920CCB92C3EF91938484
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.>.. 9.............................................................[..C........SjS...4..f.>.................t..L.h. ....1..........1.A..r......1.1........f.GRU.f9.u...... ..f9.uJ.r;......$?t........h...1.`.2.as.`1..).aOu....w/.......r.w...1.....1............RVWU...]_^Z.....f`......`.. ...."......f1.f1.f..$...f.....$..".....1.V..|W..V.............f........ ....fa...h.......<.u....Missing helper...............................X....P....r0.>..U.u(.....Kj@.......'.f1.1..D..u.8T.u.f.D.E.t....................................................................................................................[......"....1.1...f.t<..t.1.f1.f@u......U....f.......D....\.f.D.f.D.....f`.B.J.fa.fP.[.l.f@.............fXf.>......u..1..........[...........S.......Q............u.9.t.... ... .r;.....1.1.......h=..... ...1.1....................Ku..+....p.. x..............-.....-....Ku..1.....f1.6..f...............N...................../menu.lst..........................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JU0T5.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (5023), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):5377
                                                                                                                                                                                                                                  Entropy (8bit):5.404894870553585
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6439B46D6D9CB337DDF2D8E643455951
                                                                                                                                                                                                                                  SHA1:AD2D3C5E60DA82F66CF0561C22741EBBE3DEC39E
                                                                                                                                                                                                                                  SHA-256:81E13DC44E21FCA2B095E82C34294C199D37428F32DE36D5FFA6CD3B54F88D7B
                                                                                                                                                                                                                                  SHA-512:2DFD9080BC705D98C017824FC0E42EB9840F478529536D152876E48D700003301B78326C24C173A040864BF51B42B657AAF80A318D1CC82AEC05374D04894C73
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFCLOC" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="MFC90CHS.DLL" hashalg="SHA1" hash="f7e49d66e28ed50c4cb1b38b7f7cedf747df296c"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Im9J2o+5YxPWw4Al+IYL82rBB8c=</dsig:DigestValue></asmv2:hash></file> <file name="MFC90CHT.DLL" hashalg="SHA1" hash="7d0374f0a1c38c56c313f2240e18d97777f60bb5"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-JUU14.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):295432
                                                                                                                                                                                                                                  Entropy (8bit):6.417210679272527
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7729C198C1A8F374190835C0EEBA0842
                                                                                                                                                                                                                                  SHA1:7B142EDFD6A56C6768FDB03CCAFBBF4024F234E4
                                                                                                                                                                                                                                  SHA-256:71110C7F2787F5D71AA180A213CD93094FDCCFE164D4C06F496FB22CF2CDA692
                                                                                                                                                                                                                                  SHA-512:53BEEA2A153716C9BE3DB0958F85A3604FAA85F31270484607C1B40557B2B23CA5E9F2E32CA352D623D513BDC867DC56A475E09C43DF54737098618B854AF905
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................7...W.%.....&.....0.......7.....L..... .....9.......!.....'....."...Rich..................PE..L...!..e...........!.................{..............................................+.....@.........................`v..C...$].......@..D............X...*...P...<......................................@............................................text.............................. ..`.rdata...U.......V..................@..@.data....,..........................@....rsrc...D....@......................@..@.reloc...G...P...H..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-K1CUF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):40456
                                                                                                                                                                                                                                  Entropy (8bit):6.6983170865738115
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5885C433492F5195E9681490443DD2A0
                                                                                                                                                                                                                                  SHA1:610E2D5C1B433F088718A037344367D93769C9CC
                                                                                                                                                                                                                                  SHA-256:566A19CE95C25114F6D2DBCC3FD1A6026C991F5182A11A0705E19CFEE3752C50
                                                                                                                                                                                                                                  SHA-512:C2847587418938702F55D1DEEF2359E1A98507C448C0C18B061F3CDE69B633DDFBD0CE1AA31A5A3FC453457B4BD85AD6DC603E01F1122A24DF8B43906DB96BFE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jy...............W/......`,......`:......`=......`*.........K....`3......`+......`(.....Rich............PE..L...O..e...........!.....J...&.......P.......`......................................~.....@..........................s..h...\m..<....................t...*..........@a...............................f..@............`...............................text...[I.......J.................. ..`.rdata.......`.......N..............@..@.data...0............d..............@....rsrc................h..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KD9BV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):144
                                                                                                                                                                                                                                  Entropy (8bit):4.737576892694099
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6144426EB5FBC0B53788720015CDD934
                                                                                                                                                                                                                                  SHA1:38B4A816D1E992EE31BF9D6CDA9FCB1D21F5269B
                                                                                                                                                                                                                                  SHA-256:70544B831CADB45B4881C1F872D27F7BFB36AD13EBE10F21AB84B114F6FA740E
                                                                                                                                                                                                                                  SHA-512:EC8D4FC85193D0C36831E5F90452CBF667F5004B9587ED234411529381110D0A7C7311E718F2AE479ED17CD02A084639AB60976FC5D31FE972C98E26B1C4981C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>..<UserLogin>.. <Items>.. </Items>.. <Recent>.. </Recent>..</UserLogin>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KGRDP.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):130568
                                                                                                                                                                                                                                  Entropy (8bit):6.4263370316771855
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EF9A7547D3E54ECCBE56FB4E3ECD3155
                                                                                                                                                                                                                                  SHA1:EA900C49B17B225E9AEE10F17D7191AB436FB4AB
                                                                                                                                                                                                                                  SHA-256:F92C355F928BFDD418C1B91A2A97E75F4DF5700B72ACE0A594DDB658EC668AF0
                                                                                                                                                                                                                                  SHA-512:DB79ABA35017E9608EC54EEC0A7E7DBF785ADA3FC5B38B18F3F829D2F04BD06A7C29F521D83DD293CE4EC964593CCA61AEB6AC3993ECF244D69E38D958915694
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H.........x.$......'......1......6......!.............8...... ......&......#....Rich...................PE..L......e...........!.....h...h......:d..............................................,.....@.....................................d.......$................*..........................................P...@............................................text...?f.......h.................. ..`.rdata...H.......J...l..............@..@.data...8...........................@....rsrc...$...........................@..@.reloc..z...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KIIF1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):46592
                                                                                                                                                                                                                                  Entropy (8bit):5.383386767054502
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5017F29E77552C1A34CD4D835362CDD7
                                                                                                                                                                                                                                  SHA1:EBA31791876F3B7DBAA08606AA1F72944C10FB04
                                                                                                                                                                                                                                  SHA-256:3BAEC8E203787CCA2C7E6D106D92859BE6496E03AD70318167FF729472814B3D
                                                                                                                                                                                                                                  SHA-512:7E5B34776D46DA900B4266EC3BA30F736352CD2C1B80AB7E4E126A6D41AA1507973EF2134C24CF36B2EF6AF9BBE756318AA0DD8EAC00F4DEDDE152E32714CB25
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]................................O.....@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KLM5F.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):206344
                                                                                                                                                                                                                                  Entropy (8bit):6.25179839911214
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:35F40F4A694545582DF499AA3971228A
                                                                                                                                                                                                                                  SHA1:1FD973B743DF874A11B8D425A8CB5E55B6DABFE6
                                                                                                                                                                                                                                  SHA-256:9A00BBE781D973989A72BD36B6B898F30A66151D389E1789880C06F2D862198E
                                                                                                                                                                                                                                  SHA-512:C6945DC1A8CB9D2003A86159B73D634CB5375304A8E3AE32A4547ADE9D398D027AE3E7267BC5CE12A5C341006395F3B01DF06A9B56059B8F7463362F3061B135
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f...".M".M".M..$M .M+.'M%.M+.1M,.M+.6M+.M+.!M3.M".M..M+.8M,.M+. M#.M+.#M#.MRich".M........PE..L......e...........!.....&..........M........@...............................0......{$....@......................... ....................................*..........@C..................................@............@.. ............................text....%.......&.................. ..`.rdata.......@.......*..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-KS57B.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.18827298151756
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:246545D6980FC2B2DC6222401F0E5B50
                                                                                                                                                                                                                                  SHA1:EB7CC27BCDBC2240BDB6FB7B2CF1DAFB4EC4950E
                                                                                                                                                                                                                                  SHA-256:CCE75BEF6208DE3B9018A950EB786FB2F194D3A61762483718066296DB268CA7
                                                                                                                                                                                                                                  SHA-512:43BA7BBB24C95E24E04B9385717A2751EC6A920F5907CC04C0620E025DE82982DDFA7B77E14D9494E8206D5444EB5A5F7DD3436D93FF8991BE550C00681F6F2A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......].....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........?...8...8.......^*oX........d...x...x...RSDS......J.A...N.6....api-ms-win-core-interlocked-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............oX....v...................4...`...........,...e...............5...l.......................P............... ...S.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSListHead.InterlockedCompareExchange

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-L7BS5.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):86024
                                                                                                                                                                                                                                  Entropy (8bit):6.431626889185389
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2620EED0045758479BB8EEF61BA8CF85
                                                                                                                                                                                                                                  SHA1:30C1E5922092481AA20C7355B941B977C1747DBF
                                                                                                                                                                                                                                  SHA-256:5D81D602580777299439C9E30225DE1002BC41EB0AE28E79290EE307504F2330
                                                                                                                                                                                                                                  SHA-512:39774EFC0EFB29AFC26BB18C6FC7D68E8DBF76F093CBF8E3E3238D05DFA97A8C5DC86EF4E516086441F8FE6456404E00A85F1E4BD952AE9DC06A5EE5440C803A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ads`%..3%..3%..3.J.3'..3,}.3&..3,}.3(..3,}.3!..3,}.3...3%..3O..3,}.3-..3,}.3$..3,}.3$..3Rich%..3........PE..L......e...........!.........^...............................................`............@..........................)..g.......x....@...............&...*...P..........................................@............................................text............................... ..`.rdata..'J.......L..................@..@.data...d....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LCTST.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):124424
                                                                                                                                                                                                                                  Entropy (8bit):6.639154984614579
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:785DA74663D5A347B16A9319159FA80D
                                                                                                                                                                                                                                  SHA1:CB1266C504AC2A3B1BB391BDB34006147C9EFA1C
                                                                                                                                                                                                                                  SHA-256:E1238DF5592C5780C6AE9DD62224C9C2DFAF9538930272989DFC891613786FFA
                                                                                                                                                                                                                                  SHA-512:9A35A4F3972A49FBEE38951812EE18A4DC93EB1F65D0DF951B3BC1A7B44BDB2CE336DA7294750FA472D5A54B4500781A124C3B1013C20422808ECBAA38B42A58
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Pr).1.z.1.z.1.zZ~.z.1.z.I.z.1.z.I.z.1.z.I.z.1.z.I.z.1.z.1.z.1.z.I.z.1.z.I.z.1.z.I.z.1.zRich.1.z........PE..L......e...........!.....6...........0.......P.......................................`....@.........................P........y..d........................*......h....Q..............................x`..@............P...............................text...+4.......6.................. ..`.rdata...9...P...:...:..............@..@.data....7.......4...t..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LP1OB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.101908266623553
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:11B9C82C32BC5C0EA66EEB491C246F90
                                                                                                                                                                                                                                  SHA1:117677B85D7B43F1640068A2E9A202E4887BA6F8
                                                                                                                                                                                                                                  SHA-256:17B0054B9B323C9E775B719F8938CA2BB98C329566B2DE1C763AAFEECB3BF316
                                                                                                                                                                                                                                  SHA-512:B3F4FD7631FABC01A3A7FEE9C47C7B1B02F5282AE283F003851E1DE3C6442989DE5A22E1E98CAE9E8C2EDFD6BCA5AB9BA27BE08D7DF3666F5072BB73AC936F24
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......u.....@.............................9............ ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........8...8...8.......^*oX........d...p...p...RSDSn0?j.>.M.D$...W.....api-ms-win-core-util-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02......................oX....:.......................0..._...{...............Z...m.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel32.EncodePointer.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LSR9V.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):337928
                                                                                                                                                                                                                                  Entropy (8bit):6.1986980841544925
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FE090AB7F45CDD3514E7B34ECD721635
                                                                                                                                                                                                                                  SHA1:D12159E4EF777BFFD4C95E095C5E7328F8945DAD
                                                                                                                                                                                                                                  SHA-256:450AEEC5C932B22D6AD2CDE43C3F6933DB6DF8507F6B11CFF86759EAC5C83720
                                                                                                                                                                                                                                  SHA-512:9AD0B67FB0902DDEE29A8C43DE2659669D469641601E7517CBF1246BC996A6A3FEF8AFA3C4DF93B8AF876E143CD4562668FD3F25B5F58F3DEE11B288796373C9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................h.R.....Q.....@.....G.....W..........N.....V.....U...Rich..........PE..L......e...........!.........R...............................................0......6.....@..............................................................*......4$...................................q..@............................................text.............................. ..`.rdata..............................@..@.data...h...........................@....rsrc...............................@..@.reloc..D,..........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-LTDG9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):24072
                                                                                                                                                                                                                                  Entropy (8bit):6.923337004747918
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2513877799018706CD1106A0F19B1304
                                                                                                                                                                                                                                  SHA1:0D6CF30E615A46594AEEDBCB66AAD8921D002F4B
                                                                                                                                                                                                                                  SHA-256:9985D27A2E61502B7893B9614773FCCBF5607E86311CB2E474414607E442ED82
                                                                                                                                                                                                                                  SHA-512:B6B26B43DEAACC004451AAEC8E9A5E67DE137F0A9744B96668BA62605F3F88C256D86C191FEBB46ECF9050ABE0718C804039AB3D33C3D1C270C2A4CA7F905521
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................c.....`.....v.....q.....f.................d....Rich............PE..L...{..e............................[#.......0....@..........................p......F.....@..................................5..d....P...............4...*...`..<....1..............................P4..@............0...............................text............................... ..`.rdata..,....0......................@..@.data...4....@.......*..............@....rsrc........P.......,..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MHLNO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):86024
                                                                                                                                                                                                                                  Entropy (8bit):6.781646565149886
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:504734CC1D1062CC5556BF9B61BE3D8B
                                                                                                                                                                                                                                  SHA1:635B295DFF3A4AC59262AF52B7EC5B8A80360516
                                                                                                                                                                                                                                  SHA-256:0BAB51D1395BC3478D19B56FE462424E5EA5D4B56BEA6A3C5257230C42F47D3D
                                                                                                                                                                                                                                  SHA-512:75EFE459CA3309F0571DBC448EEDCECE2F54245501AD5DD4FCB4F913649BE678F8B5C9F09EC4D44731666BA4E81C2122204A4AABCAB25533747A6D108B6F48AE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ..Kd...d...d...m...A...m...r...m...9...m...c...d.......m...a...m...e...m...e...Richd...........PE..L......e...........!.........R.......+.......................................`............@.........................p...x...D...P....0...............&...*...@..h...p...............................(...@...............8............................text............................... ..`.rdata...).......*..................@..@.data...............................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MMAME.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):65032
                                                                                                                                                                                                                                  Entropy (8bit):6.36992287357445
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3B8A52B0EB69908CF4EF1AC579066DDE
                                                                                                                                                                                                                                  SHA1:847D2019BA44C9B5B26BCAC22E9AB03DFEC5F63D
                                                                                                                                                                                                                                  SHA-256:1F7D5D64FB5E4BD4E5F9361E8FEA63BB2EA1EB99DF51C6E01BF10E3D1D249C72
                                                                                                                                                                                                                                  SHA-512:4872862C3F700FCDE44C32EFA0CB895AEA4AEFB9CAD790D89F3EB8AA1EC275321EEBE32E06C4837B230B835810201569E7AC298D9803AD6339A9DA9853F5BE43
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c............MZ.....zY.....zO.....zH.....z_...........zF.....z^.....PX.....z]....Rich...........PE..L......e...........!.........F......................................................C....@.............................j.......P........................*..........@...................................@...............,............................text.............................. ..`.rdata...,..........................@..@.data...............................@....rsrc...............................@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MNN08.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):959496
                                                                                                                                                                                                                                  Entropy (8bit):6.484614050507725
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C72FC984836BBDEF11CCDA73A20F636B
                                                                                                                                                                                                                                  SHA1:C3A09CE497CE186D18CF8E752A0E503F1462AA41
                                                                                                                                                                                                                                  SHA-256:9AF9DB05CA814F924F6B397B9DB7546537F8842BAF4EAB022DA69BF1F5C6B7D8
                                                                                                                                                                                                                                  SHA-512:6AABCD14B5651712E254DF6F7D24EA154E4AE7CE9A895524979EEF1844F9C6BC401071B1747BABD2AB49CDE5F0E7C991474760F85312C4289339BD1A1C04AD1B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\)..2z..2z..2z..z.2za*.z..2z..6{.2z..1{..2zW.;{..2z..7{.2z..3{..2z..3{.2zW.3{..2zy.3{..2z..3z.2zW.7{.2zW..z..2z...z..2zW.0{..2zRich..2z........PE..L......e..........................................@......................................@.............................................(............z...*..........`...T...................X...........@...............D............................text............................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-MRTIE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):858
                                                                                                                                                                                                                                  Entropy (8bit):5.399789393361445
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1B2B5A8FA0AB8C76EC505F786A74CDB2
                                                                                                                                                                                                                                  SHA1:BD226191A48C1A268B5F57CDD1BBC10EC146AE30
                                                                                                                                                                                                                                  SHA-256:B189460384701BCC280C0AC3C9E007E705106D6B8AC8EE52E118036F496B3C1D
                                                                                                                                                                                                                                  SHA-512:B9A6ECB6F809880FF6FCA388F6B91CC362FB416D21D5A8EABDF7582A134E5408B82ED1E94E6E7ABA8D89C2F5F26AD08013AFB09C88314F52798BF8EBDDCDB27A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.OpenMP" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="vcomp90.dll" hashalg="SHA1" hash="0449830bf053b677b00100148918af34d3cb765e"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>hPU61fGgHh+hxNJrMiLhCVnevSU=</dsig:DigestValue></asmv2:hash></file>..</assembly>

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-N3LEQ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):640
                                                                                                                                                                                                                                  Entropy (8bit):5.071761651027091
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0F3B71D0FA474D73AFF7DE9CDF842732
                                                                                                                                                                                                                                  SHA1:7990F81C60B8AB722C5AD7367F69C85106BE5ED5
                                                                                                                                                                                                                                  SHA-256:5055DE34114F55B1BFAFBBBDA68EC60C4291109780B9C197557B7C222C9A4E09
                                                                                                                                                                                                                                  SHA-512:AFEAD4310E0D994D212C9E2BA1C783382FD8A434C3422D5D58EED998F9DC71F3583CA98480CEC776B0372DDC9F04FD48A2008EE14CE7AED73D65D05663CF5868
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version='1.0' encoding='UTF-8' standalone='yes'?>..<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level='asInvoker' uiAccess='false' />.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />.. </dependentAssembly>.. </dependency>..</assembly>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-N5ECB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):23048
                                                                                                                                                                                                                                  Entropy (8bit):6.817304738948663
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BA3EAEB4D316D84A6BE44BEBC712A0DE
                                                                                                                                                                                                                                  SHA1:0202A5369101D47C39B5F0C8D1FF91BE660C16A8
                                                                                                                                                                                                                                  SHA-256:6E555E3E07A5D96D0140DF2E46D279ABD0F0A91C74D5482EE8E2B55AC26C5250
                                                                                                                                                                                                                                  SHA-512:0FB8630C908840000984C0A1BA53117E4DD7972A8119E8E80C01EF81957355A83B9D18B3EFC26F420004C7AA6F25A7C0FDEB935D1F4686583854E4793E17A60A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A...A...A...H.o.@...H.y.T...H.~.B...H.i.H...A.......H.p.C...H.k.@...RichA...................PE..L......e.....................................0....@..........................p.......$....@..................................5..d....P...............0...*...`......`1..............................03..@............0..8............................text............................... ..`.rdata..b....0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-N7H5K.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.170744000121439
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:17C1F6B7E224239A45DF2760AD534AA6
                                                                                                                                                                                                                                  SHA1:340D78BB270139EC7B771B8CEF0DA92639750CEA
                                                                                                                                                                                                                                  SHA-256:0B015BE1EFC6D20E6AD2A83704C2EFDAAF3738BBEB145BC663A098345F38C82C
                                                                                                                                                                                                                                  SHA-512:16AA3356C771593C314F922004B69386AFD207F5DE5466E5DC04FBDC8E10BEB28DF4B7421EE8ABD9024083B55ABBBFBA54BD4B60B07ABDE9F25E3332BDDC71C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0............@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........<...8...8.......^*oX........d...t...t...RSDS..z..F..../......api-ms-win-core-timezone-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX....b...................,...P...............S...............I...................5...z...........)...r.....................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZoneInformation.kernel32.GetDynam

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NIP0M.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):111112
                                                                                                                                                                                                                                  Entropy (8bit):6.213043223021718
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:ACB53143600B236FA944F9EFD9F67B82
                                                                                                                                                                                                                                  SHA1:B733F61A7D51C288741DCA3870D4689305C71425
                                                                                                                                                                                                                                  SHA-256:23CA0C87ED9B2705E2900706BC8A048F45BCB2712EB9D4ADE6808AB583FF6F0C
                                                                                                                                                                                                                                  SHA-512:B10B7A3B7811FB0EF282B8513C84ACAFC6653B5347755E2D7EFD88AEC7870249C684D6B4D9381E248C806BE6A332D576DEA5B968AD8387EFCB64E7E3EFD699D7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+...x...x...x...x...x...x...x...x...x...x...x...x...x...x..x...x...x...x...x...x...xRich...x........................PE..L......e...........!................1...............................................d.....@.........................`...n...pq...........................*..........0................................Z..@............................................text...O........................... ..`.rdata...u.......v..................@..@.data...(............n..............@....rsrc................t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NLGRQ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18440
                                                                                                                                                                                                                                  Entropy (8bit):6.925122492849999
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3DB07287611E1CE2C2DEA35E1CF4B0C1
                                                                                                                                                                                                                                  SHA1:BEF996EC373D18F71345B1685A1A85DEB3517FB7
                                                                                                                                                                                                                                  SHA-256:D6C774751F4AB4B89596312AF8465B2C720D0D2138A54C58E2A43B021A230183
                                                                                                                                                                                                                                  SHA-512:30BAABF6119350ACB3015C0DC01FA6884241478C18F8C03A649CF2FAAB9EEFA306BAAFFEE558CA3047925F951E2CA80F377E20F9DDA3F74AFE1C5F78AC9E87B7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..|..|..|..u.!.}..u.7.i..u.0.~..u.'.{..|..P..u.>.~..u.%.}..Rich|..........................PE..L......e............................3........ ....@..........................`.......@....@.................................D"..P....@...................*...P..L.... ..............................(!..@............ ...............................text...~........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NNDRG.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):68104
                                                                                                                                                                                                                                  Entropy (8bit):6.531582335585765
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EC514E24309D0DE21AA3014E8108F73B
                                                                                                                                                                                                                                  SHA1:30242380A47404457027CF9C9988121513E6E47B
                                                                                                                                                                                                                                  SHA-256:66819FCCD48BB19A088FFCDE34EE0738F28B31AB06A8D6B13A438E4844EC4FF9
                                                                                                                                                                                                                                  SHA-512:C004D913D23F3795FB85C0FE2CBA6F187090A14C828F3876C1592ED47D1B6602F72D6DAD33DED03E92A5725CC460EF77B62D67665EBC0DB71091611C3AA448D4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..D..VD..VD..VMp1Va..VMp VU..VMp6V...VMp&VA..VD..V...VMp?VF..VMp$VE..VRichD..V........PE..L......e.....................N......m(............@.......................... ......(.....@.....................................<........................*..........@...............................`...@............................................text.../........................... ..`.rdata...(.......*..................@..@.data...............................@....rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NOB3N.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):72896
                                                                                                                                                                                                                                  Entropy (8bit):5.834524127443057
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2FC37A3FF68CFD063E5DD7CBA78AB662
                                                                                                                                                                                                                                  SHA1:BA1DE389B957BF0B0327D4579F089FD0AE7C1185
                                                                                                                                                                                                                                  SHA-256:2E923D6A71496460C68AF6D771BA139098918F5E2C7BDB284251DD18D0A81335
                                                                                                                                                                                                                                  SHA-512:ED45504B82BFA3331E63F662C474D61E3F041611F1594507734ACFDDCDE7C9530BA5FF7011BEAB19D70E4F3A804F98408CA0F6FD2FB7FE142C979E74CB941754
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................................................................@..............................................................<..............8............................................................................text............................... ..`.rsrc...............................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS+.t.!i.K....!,......api-ms-win-crt-private-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02..................oX.....>..................8#..h5...>...>...?../?..l?...?...?...?..&@..e@...@...@...@..,A..\A...A...A...A...B..ZB...B...B...C..PC...C...C...C...C...D..QD...D...D..5E..rE...E...E...F..7F..hF...F...F...G..EG..mG...G...G...G...H..3H..^H...H...H...H...I..MI..zI..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NSQDO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):111
                                                                                                                                                                                                                                  Entropy (8bit):4.649132961784345
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:11EA6085188129B770C7F2BC1A72567E
                                                                                                                                                                                                                                  SHA1:9C11EDAE37A78AE49A26D0F6F6F62301CBDB796E
                                                                                                                                                                                                                                  SHA-256:7BD18C3EC37B8A9F61806823796CF6AEDD884BC5CA56E54D698D7D0986A5D767
                                                                                                                                                                                                                                  SHA-512:FE5DAE1C80F0799FD283AA61F7CE14D5F3F69E63B4987788EC00BFF321F9E0AA2DE04428BA9F43CE0D87103930C31CB16D9CF12E8ABB95440508C4FE23063B42
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:[Dll]..Microsoft Outlook="OutlookDataBackup.dll"..Chrome="ChromeDataBackup.dll"..Game Save="GameDataBackup.dll"

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NSR50.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):146440
                                                                                                                                                                                                                                  Entropy (8bit):6.361410542936397
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A7E249E4A21AD971B24E05D132269599
                                                                                                                                                                                                                                  SHA1:7A5B4A7554835C40BBD7580315951BDD839F1D96
                                                                                                                                                                                                                                  SHA-256:5B48B99B14ADDF1552CCA8AE73CA057AB5EBCE6571B4A8296D0B602AA3E109D0
                                                                                                                                                                                                                                  SHA-512:191D6B3A4FFA2B3F13CCDB3FD31E2DC17DBD6036042773A5B7F595F3EB330AEC5763D33E2C5B2600A64D62B8D7CE1DB3874261541F9FB0810B9A1097757AEC9B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x..+7I..x....J..x....[..x....\..x....L..x...x...x....U..x....M..x....N..x..Rich.x..........................PE..L......e...........!................g........ ...............................`.......*....@.............................G...H...d........................*... ..."...!...............................:..@............ ...............................text...=........................... ..`.rdata..7p... ...r..................@..@.data...(f.......X..................@....rsrc...............................@..@.reloc...2... ...4..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-NTEGE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):734728
                                                                                                                                                                                                                                  Entropy (8bit):6.688961584288175
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7FCE74F0394A679A2BCE943FC2C35FC3
                                                                                                                                                                                                                                  SHA1:9F080758AB253642EE87299B44C223AD0174E2C9
                                                                                                                                                                                                                                  SHA-256:82F24CCB6A5620B375BFCB6187F82EF1DB8FBD5FBCA5B4A3CC5C9DCBDCEFA716
                                                                                                                                                                                                                                  SHA-512:64E49832A219864F49C32F6393EE019B991593C9B0467F83ED26D84475862676D70BC81D2BEF8FC8ED284D7222C76CE98BEF38E83C1AA5DA6E04E2F4ACFD42F0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........MT.s.T.s.T.s.J...P.s.]...I.s.].....s.].....s.sK....s.]...E.s.T.r..s.]...C.s.]...U.s.]...U.s.RichT.s.................PE..L......e...........!.........4......H........................................p......EX....@.............................................................*......,q..................................Hm..@...............L............................text............................... ..`.rdata..............................@..@.data...|...........................@....rsrc................v..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-O7H5R.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):45064
                                                                                                                                                                                                                                  Entropy (8bit):6.450547870743318
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E1CEDAAFBE2F1BBBEEC8B2F83528BD97
                                                                                                                                                                                                                                  SHA1:C09EF179EF42C88B39A881EB8D26619A46F4E4BF
                                                                                                                                                                                                                                  SHA-256:868F284E5E41FC8A43E596880097CF82D22F0FE667EF17284BC4A41CD04DB5DF
                                                                                                                                                                                                                                  SHA-512:845B510845B36FA5F05AC68EBD59A0A5BE729DE2C2FAEAC81E4881BEFEDCB4368674BCF40FF7DCE698C208B96604F643773753FF59B2080CBD7F61A59F691346
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..|..s/..s/..s/.../..s/.../..s/.../..s/.../..s/.../..s/..r/b.s/.../..s/.../..s/.../..s/.../..s/Rich..s/........................PE..L......e.................@...B.......G.......P....@.......................................@..........................|..b....q...........................*...........Q...............................l..@............P...............................text...L?.......@.................. ..`.rdata..b,...P.......D..............@..@.data...8............r..............@....rsrc................v..............@..@.reloc..v............~..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OB6O8.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):22016
                                                                                                                                                                                                                                  Entropy (8bit):6.017850840594142
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EA7CB849B4BCA695D0A9FB9E65909809
                                                                                                                                                                                                                                  SHA1:00D354CB92CC00A75A40FC8E670301143E292249
                                                                                                                                                                                                                                  SHA-256:706D9E6EE98C0D06EFA87C698F75CEFC81F78CFC875965E9ED738990E426B78B
                                                                                                                                                                                                                                  SHA-512:95ACF9195633275495771D7EAD1359C5A2E6E123F49EDF6E5E7823D918A0BB750FCEED4704DF6074B9DEED5751256B375437AAABF3DAED5E11A81E009C16F79D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.{.....................P.......P.......P.......P.......g.................2...........................Rich............................PE..L...|.<`...........!.........(.......2.......@............................................@.........................@M.......T.......p...............................I...............................I..@............@...............................text....,.......................... ..`.rdata..`....@.......2..............@..@.data...L....`.......N..............@....rsrc........p.......P..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OFBI6.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):75272
                                                                                                                                                                                                                                  Entropy (8bit):6.3930647558837626
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DD9C2F00D4675CB281970467C06F4E3B
                                                                                                                                                                                                                                  SHA1:4E36F908957426897498F6C20367DAAFFADABDD5
                                                                                                                                                                                                                                  SHA-256:04A26019899AE046AB7E4BADE499B6AB41B12B8CF6A169B61AD0F46799645C34
                                                                                                                                                                                                                                  SHA-512:08DB6BC123C1D586DFE08BB4ADDEE85A087EBA3078585DFB642A1E830E7E51558D94BB2379984150854F211F9A85883A7F965A80EEE80DFE028C45C4208E7772
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h...................................................................Rich....................PE..L......e...........!.........<...............................................0.......&....@.............................l.......P........................*... ..........................................@...............l............................text.............................. ..`.rdata..,&.......(..................@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-ONK4G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):25096
                                                                                                                                                                                                                                  Entropy (8bit):6.831056879331962
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4A77BDD49B717B97CA014799B548858D
                                                                                                                                                                                                                                  SHA1:6544471550220AC8D6ABD3C4506EA3F60389CF1C
                                                                                                                                                                                                                                  SHA-256:CEC1F39A9C9208779E8BABB3174A464068ABD19F890AC4FAC56110008E18F799
                                                                                                                                                                                                                                  SHA-512:36E32F95EB17BFB44DE3A5031F293132610ED49968A649D056D13A58DCDDB0F9B16BF37C8D1C01CFDDCE6548BFEFB8B1D008D561D97EDE4495DF5102B9CA8D9F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.|.V{/.V{/.V{/.../.V{/.../.V{/.../.V{/.../.V{/.../.V{/.Vz/.V{/.../.V{/.../.V{/.../.V{/Rich.V{/................PE..L...{..e...........!.................".......0...............................p............@..........................>..k...d9..P....P...............8...*...`..0....1...............................4..@............0...............................text............................... ..`.rdata.......0......................@..@.data...0....@......................@....rsrc........P.......0..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OPDVO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):303112
                                                                                                                                                                                                                                  Entropy (8bit):6.247534927368605
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:64C52D50D8C92688CF7B001B50437C79
                                                                                                                                                                                                                                  SHA1:B8C60174D3147E56D790FEFF45989D67A5118374
                                                                                                                                                                                                                                  SHA-256:01393A2AB5659B832BFD75FB4F311A4404851FEEA079653997A0D7A6A004ABA3
                                                                                                                                                                                                                                  SHA-512:63CC7BC5BE3A07813EF1A6285C1070799C7B95347E7E37938CF6BC8DE5216CBD5075FF88A890FFAFDA3398CC03A4433C03D18132536AC21C0B31BD9D413717BD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...D...D...D......D......D......D.......D......D...E.u.D......D......D......D......D.Rich..D.........PE..L......e...........!.....>...4...............P......................................B8....@..........................I......d*.......`...............v...*...p... ..PS..................................@............P..$............................text....<.......>.................. ..`.rdata.......P.......B..............@..@.data........P.......<..............@....rsrc........`.......D..............@..@.reloc...)...p...*...L..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-OQEG2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):78856
                                                                                                                                                                                                                                  Entropy (8bit):6.610066806399205
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:18D516AE83D6287C932B63E763C1A6E6
                                                                                                                                                                                                                                  SHA1:2898FF64E677366EA6ACE8FF47AA7C23F2E51D02
                                                                                                                                                                                                                                  SHA-256:BDC8B789C582590C2039910C2CA7828419D813AE4BD19CDA9A35CBD69042B148
                                                                                                                                                                                                                                  SHA-512:FEE3E347325EB53964BBF5FF761F94B8C18042F4F313DCF6875FEDB35C87784D576CDF9E516DB9D7BFA637DD1318C18ED6B74D79A5CD2AF10B05E9DA3DD30B3D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............D...D...Dy.}D...D.~D...D.hD...D.oD...D.xD...D...D...D.aD...D.yD...D.zD...DRich...D........................PE..L...M..e...........!.........v...............................................0.......n....@.........................@.......,...d........................*... ......`...................................@...............@............................text............................... ..`.rdata..n(.......*..................@..@.data....?.......<..................@....rsrc...............................@..@.reloc..p.... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P1D83.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):394248
                                                                                                                                                                                                                                  Entropy (8bit):6.227874392917987
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FC092AA3B8E555CFB9D3AF4AB2DEB7D5
                                                                                                                                                                                                                                  SHA1:70D932EA62C95CA01562F02F0CB2B78B8913063A
                                                                                                                                                                                                                                  SHA-256:89812A873768F4688BA714618B6C4D810927A822D97BA628457CC1854650537F
                                                                                                                                                                                                                                  SHA-512:1B2E4B986796E8222686C73A8A57A706DAAB826941ECC63B01D172B6CA2422676C4590D8BA9DA6A435FF0F4E95469E097A57486863247293579877BC5C1D025D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o...5.n..f.6.i..f. .v..f.'.d..f.0.d..o.....f.).w..f.1.n..f.2.n..Richo..................PE..L...\..e...........!.....v...`......E...............................................U.....@............................g...`...x........................*..........P...............................hq..@...............0............................text....t.......v.................. ..`.rdata..7........ ...z..............@..@.data...............................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P3FKA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):173064
                                                                                                                                                                                                                                  Entropy (8bit):6.79725745688718
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7445879C43B9DB5A5CE76A06CE181A38
                                                                                                                                                                                                                                  SHA1:71AF104DE79C368F4A53C4A6CE974FACF5E61D35
                                                                                                                                                                                                                                  SHA-256:E730811E28FD3CC42399C7D2C89BA435BD2FE3488909FEA1A8CBF240117C65BA
                                                                                                                                                                                                                                  SHA-512:15ABF8ACC94EC9D151A40D6AAB4D704D1EDD919C5335C9750812FB55ADE66F9757B1D22680E05346EE9EFFEFA50F4F3B663D0C2486D13847BADA3CDCEA321655
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+e5.o.[.o.[.o.[..K..n.[.f|..h.[.f|..b.[.o.Z...[.f|..y.[.f|..i.[.f|..g.[.f|..n.[.f|..n.[.Richo.[.................PE..L......e...........!.................................................................,....@..........................h.._....Y.......................z...*...........................................V..@............................................text...~........................... ..`.rdata..O...........................@..@.data...,....p.......V..............@....rsrc................j..............@..@.reloc...............n..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P3HRB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.1368866999033695
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6BC77942A02C620F985F77338CF9FED2
                                                                                                                                                                                                                                  SHA1:9394DC62C5A6195BA3371B8A1FB9302B37D65E70
                                                                                                                                                                                                                                  SHA-256:9C74AB29CC474214B690BE7F35668EB31C9141CD98F43DF66EB1D960C47580D2
                                                                                                                                                                                                                                  SHA-512:1A3EFDE70E835F49A46D8E141AB5F9A4DF8C45FB7692A7ED5DCCDA0BA368F028ADAAE7B511D49B475E9A1890BD8C70B5A4DEC1869051196BD6FA3614EAEDBB28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......r.....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........:...8...8.......^*oX........d...t...t...RSDS.E(v..8E.....e.V....api-ms-win-core-string-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX....X...................(...H.................../...X...........z...................I...p.......................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.CompareStringOrdinal.CompareStringW.ker

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P63FK.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.139970738651813
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:154A0B0E4DF921852B403F9C3710EBE0
                                                                                                                                                                                                                                  SHA1:E6CB14F232A85609931704B006BD3950BAF0A874
                                                                                                                                                                                                                                  SHA-256:58C9475A169EECBEF8A404A73FDA8C4F57282E66E74BA19A1F5C081E9CEE7207
                                                                                                                                                                                                                                  SHA-512:A325BDB2AC6F854251AA742FCFA771769C3E8843BDD2BF8ACF6BE170C419F8A65473C2E3B9B149AA61F6452B39749E171FE5945B9D601C356C254CD18DEB4754
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0......=.....@.............................v............ ...................<..............8............................................................................text...V........................... ..`.rsrc........ ......................@..@....^*oX........9...8...8.......^*oX........d...t...t...RSDS...T.=hC....NNz.....api-ms-win-core-synch-l1-2-0.pdb............8....rdata..8........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02..................oX........................L...........2...o...............7...}...............B...s...............7...........W...................\...............(...e...............!.....................................api-ms-win-core-synch-l1-2-0.dll.DeleteSynchronization

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-P6P07.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):28864
                                                                                                                                                                                                                                  Entropy (8bit):6.665754680452506
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6DB484B0D207FD72B5DB5CA490BD4CA5
                                                                                                                                                                                                                                  SHA1:8B7A5BB7CE4007B26545FD22902048E05A646446
                                                                                                                                                                                                                                  SHA-256:1D8E2B59452B927CC3E0F75B2D5277B667A503C53507FDAC11D3D8B44986080D
                                                                                                                                                                                                                                  SHA-512:9419CE9148F7C6A473412036BCBCA9672F47390295E8A84858F50556C22B66A7385BCEE089715ECD7FF1CF5C59257717A75444BEE1A4D3E4332326BBC407E0FA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!.........................@...............................P......./....@..............................+...........@...............4...<..............8............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@....^*oX........7...8...8.......^*oX........d...p...p...RSDSy..H...N.`N..%.U....api-ms-win-crt-math-l1-1-0.pdb..........8....rdata..8........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02......................oX....L.......:...:...............s........................... ...8...Q...j...............................-...G...b...}.................... ..I ..u ... ... ... ..%!..O!..y!...!...!...!..&"..S"..}"..."..."..."..%#..O#..z#...#...#...#...#...$..$$..<$..S$..h$..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PFJG5.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1406
                                                                                                                                                                                                                                  Entropy (8bit):3.8691759544989712
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:643FE6367E0B95C79DE12F7BD0EC7399
                                                                                                                                                                                                                                  SHA1:82F5B0908D33CEC3D4FC3461904AD78149293F37
                                                                                                                                                                                                                                  SHA-256:5FF7D17A6091E6D7FCAC50FC43A5348DF5DA573606A0E3264FC3B8E2C129CDED
                                                                                                                                                                                                                                  SHA-512:1B0920892897C8B2DC36785E44797B4EFCA7942D6659BC8965D7E81282C29795307E02E41207788FC461015DC8D7C1D295EAFD3DF673801F834195E9FF778B99
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......[.C.o.n.f.i.g.].....L.O.G.E.N.D.P.O.I.N.T.=.W.k.Z.o.T.m.R.G.c.F.h.S.b.n.B.r.U.X.p.C.N.F.R.H.M.T.R.k.b.H.A.1.T.l.d.o.a.V.I.y.d.z.F.a.R.m.M.x.Y.W.1.O.N.U.5.X.c.G.l.N.a.k.E.5.....A.C.C.E.S.S.K.E.Y.I.D.=.V.k.V.a.U.1.F.s.T.l.Z.T.a.1.Z.U.U.0.d.S.T.l.V.6.Q.j.B.N.b.U.1.3.W.j.N.o.U.F.V.U.M.D.k.=.....A.C.C.E.S.S.K.E.Y.S.E.C.R.E.T.=.V.1.d.4.T.2.Q.w.O.U.d.a.R.n.B.O.U.k.V.a.T.1.d.q.T.m.9.T.b.E.Z.1.V.G.p.G.U.2.V.r.W.k.t.Z.M.V.J.D.Y.z.A.x.W.G.F.G.T.l.d.h.b.V.J.o.V.1.d.0.T.m.V.R.P.T.0.=.....P.R.O.J.E.C.T.N.A.M.E.=.V.2.x.k.R.2.V.s.c.F.l.W.b.n.B.o.V.n.p.W.d.F.l.u.Y.z.l.Q.U.T.0.9.....L.O.G.S.T.O.R.E.N.A.M.E.=.W.W.t.j.N.W.J.t.T.X.p.V.b.l.p.q.Y.l.Z.a.b.V.p.F.Z.E.t.k.M.W.d.5.Y.k.h.j.P.Q.=.=.....L.O.G.S.T.O.R.E.N.A.M.E.2.=.W.W.t.j.N.W.J.t.T.X.p.V.b.l.p.q.Y.l.Z.a.b.V.p.F.Z.E.t.k.M.W.d.5.T.l.h.a.a.F.d.F.R.T.k.=.....b.A.l.l.o.w.S.e.n.d.I.n.f.o.=.1.....b.A.u.t.o.A.d.d.U.i.d.=.1.....b.A.u.t.o.A.d.d.T.i.m.e.s.t.a.m.p.=.1.....b.G.e.n.e.r.a.t.e.T.e.s.t.I.n.f.o.=.1.....n.b.L.i.m.i.t.K.e.y.v.a.l.u.e.M.a.x.L.e.n.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PFLD8.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1339400
                                                                                                                                                                                                                                  Entropy (8bit):6.580319157175123
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2C75F8E56180E970BD0803E31D888F39
                                                                                                                                                                                                                                  SHA1:22AF894278C39D717A416FDADA61DC710FE4CB74
                                                                                                                                                                                                                                  SHA-256:E783F264392603565579797B2F958B9C2E4690D5DC4D84DB3A5BCDE98BB82CDD
                                                                                                                                                                                                                                  SHA-512:166F1DA0FB35335B9B98371A7CDECF1B0E347F83397C28F6D24106D7134137CF2EF2E12CD53BB5D02378031D9A15B37B84A2FEE9705116A13483E2ABB880D853
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jm..........."D.....s.....s........0...s.....s.....s......s.....Y.....s.....Rich............................PE..L......e...........!.....H...................`.......................................i....@.................................L........ ...............F...*...0...Y...b...............................2..@............`...............................text....F.......H.................. ..`.rdata..+\...`...^...L..............@..@.data....T.......(..................@....rsrc........ ......................@..@.reloc...j...0...l..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PGH7M.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):374280
                                                                                                                                                                                                                                  Entropy (8bit):6.33392580520524
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7B8BA5A0C6FB5B4EC231E1616FA19EB2
                                                                                                                                                                                                                                  SHA1:E26162BDB325024EF41B5578A17C66EE313A48B6
                                                                                                                                                                                                                                  SHA-256:BAF0F648F53277350286FE3380731F1F270B26ADEDFE561295F11D7F2CD647A0
                                                                                                                                                                                                                                  SHA-512:7FC33245D1DFF2748D7B7EC6F4B03C7472AA3BEBCCE0C41884A6D98B07A6A6F5DF196C4E6AC9DE5AD8AF375293ECB517002C65416E6EA6C33C6E5BABFDD2FD66
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.....}...}...}......}......}.......}.......}......}...|.2.}.A.n...}.......}......}......}.Rich..}.........................PE..L...-..e...........!.....................................................................@..........................................@...................*...P..(L......................................@............................................text.............................. ..`.rdata..a...........................@..@.data....r.......T..................@....rsrc........@......................@..@.reloc..T....P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PIGQC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):29704
                                                                                                                                                                                                                                  Entropy (8bit):6.763249117995234
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:05356ECFF776BE4F509A433BB278A074
                                                                                                                                                                                                                                  SHA1:24792657913377C6F2D9D2D2E7174330827E3E9F
                                                                                                                                                                                                                                  SHA-256:D4ADB065FD3336AB28FCB7670EC98F4445A1314079337C17D6147BA0C73E1F9A
                                                                                                                                                                                                                                  SHA-512:A01912739CFE24DC3495638EFB4AD71BE1B78243AC1071091728443A18D7D61EAA561865E4029F02E7E783DDED12B051BE37A7BA313273FEDA5D18DA622D5360
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(p.I...I...I.......I...1...I...1...I...1...I...1...I...I...I...1...I...1...I...1...I..Rich.I..........................PE..L......e...........!.........,......_!.......0......................................<.....@..........................?.......8..P....p...............J...*...........0...............................5..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......2..............@....rsrc........p.......B..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PN7VE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):68616
                                                                                                                                                                                                                                  Entropy (8bit):6.530939604274132
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CCD6BED4C2B312C27ED8D40937FA446F
                                                                                                                                                                                                                                  SHA1:118DDB102C5472A059A7E59A748AAC152685CDF2
                                                                                                                                                                                                                                  SHA-256:561E9D6B6524E8D14C5A6AE6C13A0682294796EC1823887635BBCD62DB8D835D
                                                                                                                                                                                                                                  SHA-512:2E982B699667C7877D9CF319900297313AE20E456633FFFC048867D0C69DCC63A392125C96ED3EC68928A772EEE32E5CDCA4A678F49E0B387293896F767E2252
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m3A..]...]...]..C....]..t....]..t....]..t....]...\.).]..t....]..t....]..t....]..^....]..t....].Rich..].........................PE..L...u..e...........!.........N......................................................'....@.....................................x........................*.............................................@............................................text...[........................... ..`.rdata..b/.......0..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-PTHJ8.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):36360
                                                                                                                                                                                                                                  Entropy (8bit):6.666387180948688
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:989233DEA432C6F5668E26E75090B0DE
                                                                                                                                                                                                                                  SHA1:F36780DD4451F7AFB14E8411271123618BEFB8BB
                                                                                                                                                                                                                                  SHA-256:7CA70C61C214DA2FE1C9B94144EF805D4804CDE49996ACBD222E06A366065AA3
                                                                                                                                                                                                                                  SHA-512:EAB3B84C98FC84C7C5394A7BE39D3864BEAE4617D80F86CDC675C4EBF5D9E704D70DC48170EC58281E80AC69AAF4AB7E73898ABBFF521AEEFD71242CA167C03A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.K.y.%.y.%.y.%....x.%.p...x.%.p...w.%.p...q.%.p...~.%.y.$.>.%.p...u.%.p...x.%.p...x.%.Richy.%.........................PE..L...g..e...........!.....6...*.......<.......P.......................................#....@..........................e.......^..P....................d...*.......... Q...............................S..@............P...............................text...K4.......6.................. ..`.rdata..l....P.......:..............@..@.data........p.......R..............@....rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q050A.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1496584
                                                                                                                                                                                                                                  Entropy (8bit):6.340392475732196
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E654FF2BE0F55AA08D5BA581A1759783
                                                                                                                                                                                                                                  SHA1:4773DA9269ECC1694142D7EDBFE0CF4431ECAFE4
                                                                                                                                                                                                                                  SHA-256:DBA1122298AB5FE72B0B959782D983C8B43F001FABE7B76430D50F501D666A7F
                                                                                                                                                                                                                                  SHA-512:CF6F36D2B08BFA52CF33EFBBFF866F3B8F435A4F4F9C15F8FB84999DAB60C69AB79937019B56F66D97B72C40C958126EE9A047590CD1A914DCC228F5BA69B6E3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..#vnopvnopvnop.!.pwnop...p.nop...ponop...p{nop...pgnopvnnp.nop...p.nop...pwnop...pwnopRichvnop........PE..L......e...........!.....D...d......S........`............................... .......d....@..............................................................*.......m.. d..............................pI..@............`...............................text..._B.......D.................. ..`.rdata......`.......H..............@..@.data....j.......,..................@....rsrc...............................@..@.reloc..6............ ..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q376I.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):630280
                                                                                                                                                                                                                                  Entropy (8bit):3.43242024117231
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F5F2411ACD6D6095604EE91180EC35BA
                                                                                                                                                                                                                                  SHA1:719BB9A557E44C8DEBCC7958E1DC46EE80C4B588
                                                                                                                                                                                                                                  SHA-256:D24EC5F9171C4F1944421A45A687E618E1CC1009741DCB8E94B9797809DA6EE7
                                                                                                                                                                                                                                  SHA-512:0F971939E8670E3D6499A04954E7AB7E28837078DC73C27EE002E17DBF39C18C26487B08E96CA2CF1096529060B481EF7B71E74B4BE652953585AC977B9F0BEF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^...^...^..v.Y..^...&Z..^...&L..^...&K..^...&\..^...^..8^..}...^...&E..^...&]..^....[..^...&^..^..Rich.^..................PE..L...$..e...........!......................................................................@.........................p&..$...D........`...............t...*...p..x&.....................................@............................................text...+........................... ..`.rdata..............................@..@.data....'...0...$..................@....rsrc........`.......<..............@..@.reloc..r/...p...0...D..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-Q6CRH.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):102400
                                                                                                                                                                                                                                  Entropy (8bit):5.742247638564425
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2DC27034C8FDF782C245C0B6CD27778C
                                                                                                                                                                                                                                  SHA1:C6326BEB793F52B9DC456C1A2074C6199AB57EB9
                                                                                                                                                                                                                                  SHA-256:90A9ECC1F37C526C952BB86B47B0DF50D85175C7BB3A0EA59B90FE58FDAB2EB6
                                                                                                                                                                                                                                  SHA-512:118E46AA3B350C8E9629C17B4840764CDC089C62E18F2B1DC7742BF8EC41A65DC04F5ECBFD751C2666A9BD9FF71A37A082937B4F0D91D8F0F9465A757D865A60
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VM...,...,...,..p3...,..}3...,...0...,..}3...,..}3...,..k....,..k....,...,...,..K....,.......,...*...,.......,..Rich.,..................PE..L...l..K...........!................]...............................................................................p%...+...........p..H.......................8....................................................................................text...2........................... ..`.rdata...P.......`..................@..@.data...8....`.......`..............@....rsrc...H....p.......p..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QAQLD.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):24576
                                                                                                                                                                                                                                  Entropy (8bit):3.0910915076443017
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:363A3225BC21D3415E07B901F869EACD
                                                                                                                                                                                                                                  SHA1:7FFC3330DE2B3612E8194A3C26E52F1553882F63
                                                                                                                                                                                                                                  SHA-256:751E5839F1AC526DD5229D315D9A20E14D57B5278E49A9CD08C0FD4C8ABE7DC8
                                                                                                                                                                                                                                  SHA-512:2E8382D60A0E8D8ED998746C008B579EDEBA6933B553D97D3E32BF3C48A23AA75190F6BF171DB4B58FF2EE7CC5BB4BDF882DDE66E0748D40C834D8CDCA286C35
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:regf%...%...!.6[.................... ....P......\.?.?.\.c.:.\.b.c.d...r.s.t.......................................8........O..q..8........O..q.......8........O..q.rmtm....................................................................................................................................................................................................................................................................................................................................................f..k........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QEK86.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):17600
                                                                                                                                                                                                                                  Entropy (8bit):7.204294163501777
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:84B028DA34AE530B30412096AA49553E
                                                                                                                                                                                                                                  SHA1:C10A7B6ECCE114ACCE7A2016190BFD4C8F8BF7BE
                                                                                                                                                                                                                                  SHA-256:9B84CE7988732EF57B8EA9288E5F2C68A30341FDEBF845B871AC855BA298ACAC
                                                                                                                                                                                                                                  SHA-512:46C69FBFFAB31FDE22D350879A8C2B2DBFF42D3502521D1BA56C63A770FE32B97BDFAF4693F7FC2BC470D2ADE6113F613B2BD909A5396F409A87BE258742FE7B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0.......:....@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........<...8...8.......^*oX........d...t...t...RSDS./....8F.6.v.n......api-ms-win-core-datetime-l1-1-0.pdb.........8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..................oX....0.......................(...c...............T...{...................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA.GetTimeFormatW.kernel32.GetTime

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QHPQ6.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):616
                                                                                                                                                                                                                                  Entropy (8bit):5.070874186461117
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F45FEDFCCE4A78FD25EA62CE9C2F089F
                                                                                                                                                                                                                                  SHA1:FF2F255A5A9342F3B494B96BAD04F3687623F0A7
                                                                                                                                                                                                                                  SHA-256:355F202FFD0106F6AF1810742223CD92F96A63F0E4867D963152CB52B171653B
                                                                                                                                                                                                                                  SHA-512:01740F858AC78561F447710F00590F160E9FAEE7E7AC085FF4CCDDA0AC9A0147BAD8C810F52AE78CAD13B8DC81F6FD2869121BEB3ACB3BBC04A48861BBFB59A3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version='1.0' encoding='UTF-8' standalone='yes'?>..<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level='asInvoker' uiAccess='false' />.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.VC90.CRT' version='9.0.21022.8' processorArchitecture='x86' publicKeyToken='1fc8b3b9a1e18e3b' />.. </dependentAssembly>.. </dependency>..</assembly>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QJ18N.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):88
                                                                                                                                                                                                                                  Entropy (8bit):3.150298806897328
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7F411750D07619F38537E7FD612B8B44
                                                                                                                                                                                                                                  SHA1:CDA241A1CE5141288582C8F0AC4850992B427BDC
                                                                                                                                                                                                                                  SHA-256:AE89726AF2BD0C0218FBF63AF20D4464F44DCED5156364D817B6E73AFC8E9F87
                                                                                                                                                                                                                                  SHA-512:35DAD46325060004A66E01E10AF6A3EBFD94B6751347B6EC64840C4EC03D81480FC324494EA39DDED03BF2F1A1CE352B15AB518D14214C15567AF17FB32F16B8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......[.H.E.A.D._.D.A.T.A.].....T.O.T.A.L.C.O.U.N.T.=.0.....S.T.A.R.T.I.N.D.E.X.=.0.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QJF4F.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):266248
                                                                                                                                                                                                                                  Entropy (8bit):6.523471797411328
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EAD49ECDBEFA4A8ED0BEB09C667EA5E9
                                                                                                                                                                                                                                  SHA1:979544CA46B974D716F4A221B1D1F2247AA50CB0
                                                                                                                                                                                                                                  SHA-256:BFD035A18965F384F2DBD85F83C46DA8A99CF3C28AAE284259509EE0E7070DD6
                                                                                                                                                                                                                                  SHA-512:E04BA7FF1571A9610FECF2ED80B6325F8713297FF34C57495E0A2A3BFED4BABF3E85FC9F7F27338DE687DCFA52EE730480AF8B3515D6073D6510D650C41A8BE4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9..D9..D9..D0.sD,..D0.bD|..D0.eD...D0.uD<..D9..DQ..D0.lD0..D0.tD8..D0.wD8..DRich9..D........................PE..L...~..e...........!........................................................@.......Q....@.....................................<........................*..............................................@...............|............................text...A........................... ..`.rdata..............................@..@.data....6..........................@....rsrc...............................@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QKKTU.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1122312
                                                                                                                                                                                                                                  Entropy (8bit):6.15772441442382
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F3B19DC141C6FCAE3BCFD1D9D7D0759B
                                                                                                                                                                                                                                  SHA1:C9D4EC06853638AD6655266D133A8DE13776AC3C
                                                                                                                                                                                                                                  SHA-256:79A9293AE39B984BFE083B00C0E44C40B75B2D2F418AE89A2996636C0521E71D
                                                                                                                                                                                                                                  SHA-512:ED67BDC984ABBE7CEF10D2C8F2BE9C852CADAC83D44F7AA9F4075F6F759C6946CE3FCD9BE876EB666EAC0DF47BBDF5976CB9FBDB5401655541BDDBE166297AB7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........D.D.D.....F.M...F.M...K.M...K....F.M...a.D...M...~.M...E.M...E.RichD.........PE..L...`..e...........!.....x...z......O#.......................................@.......A....@..........................@......|...|........................*.......\..................................`r..@............................................text...*v.......x.................. ..`.rdata..3............|..............@..@.data...\U...`...@...D..............@....rsrc...............................@..@.reloc...m.......n..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QKS7C.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):655872
                                                                                                                                                                                                                                  Entropy (8bit):6.890160476095281
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E7D91D008FE76423962B91C43C88E4EB
                                                                                                                                                                                                                                  SHA1:29268EF0CD220AD3C5E9812BEFD3F5759B27A266
                                                                                                                                                                                                                                  SHA-256:ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
                                                                                                                                                                                                                                  SHA-512:C3D5DA1631860C92DECF4393D57D8BFF0C7A80758C9B9678D291B449BE536465BDA7A4C917E77B58A82D1D7BFC1F4B3BEE9216D531086659C40C41FEBCDCAE92
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...a...a...a..,....a...a...a...3)..`...3?.^a...3...a...38..a...3>..a...3;..a..Rich.a..................PE..L....=1G...........!.....Z..........@-.......p....Rx.........................0............@.........................`....|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QMON9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):47104
                                                                                                                                                                                                                                  Entropy (8bit):5.301682061872903
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:90C9666E1F1BB578C35C26CFCE10E2D8
                                                                                                                                                                                                                                  SHA1:B2D0E230E4D03ECD0D7F503DBED75142331C6353
                                                                                                                                                                                                                                  SHA-256:6B6259B876972EB7507D052D4EAC068555BEA6973643DB7050C6606D46BEECA7
                                                                                                                                                                                                                                  SHA-512:075ADB3657FDE64347DF20208E73187211A181CD83186F3EEFE9B797DA2706B9C4F40FE2C3AA2C61C0D5AB14461A630EB0E3DFB4D189AB7238AB6B43727126A8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]................................W+....@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QQRUA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):52232
                                                                                                                                                                                                                                  Entropy (8bit):6.709197342540284
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DB48C9472F3CD5F44624733D75D69CD2
                                                                                                                                                                                                                                  SHA1:CAB150E375C085F4E713A25024DC35F1CD3757EE
                                                                                                                                                                                                                                  SHA-256:08AFD687B136542DD284DB80947DD5E4E79F80CB7177DC0B99B261335CC8A730
                                                                                                                                                                                                                                  SHA-512:D1B1FECA151E32E94F5F694726094D81BB50C6691DA79B1A583D7EE9AAB2D994AC048028FCE029607531C2788821BA332A08C6B3CDE02A453A26B5CAD4B222AA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)[|.H5/.H5/.H5/'../.H5/.0./.H5/.0./.H5/.../.H5/.0./.H5/.0./.H5/.H4/.H5/.0./.H5/.0./.H5/.0./.H5/Rich.H5/........PE..L......e...........!.....h...6.......j....................................................@.........................0...........x........................*......d...................................p...@............................................text...{f.......h.................. ..`.rdata...#.......$...l..............@..@.data...............................@....rsrc...............................@..@.reloc..f...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-QUVG6.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):41472
                                                                                                                                                                                                                                  Entropy (8bit):5.296165395780056
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FC1F85E5D3F477E8A9351B5A0A9BCDCC
                                                                                                                                                                                                                                  SHA1:226F49DA8FB96313D6C38025F8860BF36AC107C7
                                                                                                                                                                                                                                  SHA-256:5936DD619E57EB295172AD930890478D67FABEFE6EB26997C5706127C5395C15
                                                                                                                                                                                                                                  SHA-512:392B67F0EFCE9254ED2ADDEBB3031C8DE6535127773D83B4101AFCA90E6456F5DE499361B6DAFA78C6EB1BF73DFBEC43355FC598E4D6EFCDBE90C8ABDC96ECDF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!.........|....................6]......................................@..............................................z...........~...$...........................................................................................rsrc....z.......|..................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R0INC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):213000
                                                                                                                                                                                                                                  Entropy (8bit):6.124668991857604
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D8F2989A1D7799C27ED8E8DE02467191
                                                                                                                                                                                                                                  SHA1:8DA7E0E5FCD8AEE9890F2D954B5B2F6BA0C756C4
                                                                                                                                                                                                                                  SHA-256:DBC745626B6F2E983F0D7A9A665D2ED07C209AD3B6CE2C2A349FC8B1FE0F7C63
                                                                                                                                                                                                                                  SHA-512:1F6AC545EB734255CAD02CD86BA665014AEBB8792AD851EF72AFFE754A068FD4ED572422B4F3F1B92B064AA5A26556D0224B3B2ABC92AE997C08D51EA46958E6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O5...T...T...T....`..T...,c..T...,u..T...,r..T...,e..T...T...T...,|..T...,d..T...,g..T..Rich.T..........................PE..L......e...........!.........................................................P............@.........................p.......$...P.... ...................*...0...... ...................................@............................................text...k........................... ..`.rdata..............................@..@.data...............................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R1GCB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):83464
                                                                                                                                                                                                                                  Entropy (8bit):6.197967059963992
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B96F508C8904AA63C023BFF0E27FC85B
                                                                                                                                                                                                                                  SHA1:DAFA3A971A7FC227E8CE0CBE52F87AEA4C13C5F2
                                                                                                                                                                                                                                  SHA-256:9438947C2833AB78A473B08FEAF5A22B615D16F54D483DE54E6296EE23ECA7E0
                                                                                                                                                                                                                                  SHA-512:993DEBC76B6A16BD87C77C4F1F6765FF36B03DD686A6E144C7D41C7B1765B0A4D7E4051684D8C9FCA06DBA645B40EBDDC5EF019FFF49F9C8A330A2370691930A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q/v.5N..5N..5N.....4N..<6..4N..<6..;N..<6..2N..<6..0N..5N...N..<6..6N..<6..4N..+...4N..<6..4N..Rich5N..........................PE..L...{..e...........!.........B...............................................P......A.....@.........................`.......<...<....0...................*...@..........................................@............................................text............................... ..`.rdata...$.......&..................@..@.data........ ......................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-R1L06.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):116744
                                                                                                                                                                                                                                  Entropy (8bit):6.348495759709765
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C1B106AC0E45B53CF656CF75D65F64C0
                                                                                                                                                                                                                                  SHA1:77D8FCA6D9E7A761B29ECB47999D24ED7A2DEB55
                                                                                                                                                                                                                                  SHA-256:DA32A33A3D92D8672EF5CEFCB7F445908A2CBDB3A89A0CE4F3C02C4F3E482E84
                                                                                                                                                                                                                                  SHA-512:104EA7A3307CF8E23847314337195C7B244D558225D1E90E09208BC5EADEA7EC4223D371FF9B2DBDC7E0487E8573C2C723A417ACEF788D4F7133D36708017FFF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......qP:,51T.51T.51T.<I..=1T.gYU~11T.....41T.gYQ~#1T.gYP~?1T.gYW~41T.ZUR~41T.ZUP~41T.ZUU~>1T.51U..1T..X]~<1T..XT~41T..X..41T.51..41T..XV~41T.Rich51T.........................PE..L......e...........!................G........0............................................@..............................................................*......X...0w..p............................w..@............0...............................text............................... ..`.rdata..`l...0...n..................@..@.data...............................@....rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RAPEG.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Generic INItialization configuration [ImageLimitSize]
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):198
                                                                                                                                                                                                                                  Entropy (8bit):4.986154742203363
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4116E1C615D612FB69033D08EA83D64B
                                                                                                                                                                                                                                  SHA1:5377C00D712A508EC04C4950EB53A75104124385
                                                                                                                                                                                                                                  SHA-256:BE194C1A6B535856C54E3370294935B1AF462B7771A59C2BEF9AA9BD4ECF8E9A
                                                                                                                                                                                                                                  SHA-512:2D7518D0CBBE40E908A20CB0A361B5CAFEDAC7F2BF74B69BC6DA8A510E6BDBE21DAAEE84BC1069003F34F1CAFFD8B969CF9A42FFBB6A2E64B686B1BFD540904D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:[Debug]..TRACEARG=0....[ImageLimitSize]..OneDriveBusiness=5120..OneDrive=5120..GoogleDrive=5120..DropoxBoxBusiness=5120..DropBox=5120..Box=2048 ..Mega=5120..pCloud=5120..Sugarsync=5120..HiDrive=5120

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-REBNB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):228360
                                                                                                                                                                                                                                  Entropy (8bit):6.718677733185839
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F9E85A7871E66EDF898FDDF72853B385
                                                                                                                                                                                                                                  SHA1:BE6EEF07B3C318F905B1B9782630ABE7E7E87AF9
                                                                                                                                                                                                                                  SHA-256:10836532E3BB055C054D06101493155B2C4FED162C52EEFCC06794C0B3B304C8
                                                                                                                                                                                                                                  SHA-512:88975BA19245DAD4952738D1173C0CCF30BF827404182B41CF9F51888FD714E541E0EE8FB8D38985BCC92B4986114A40082B4EF6019FBDD65D954B5878AE334D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P.Q.>.Q.>.Q.>....S.>.X...V.>.X...^.>.X...Y.>.X...\.>.Q.?...>.X...^.>.X...P.>.X...P.>.RichQ.>.........PE..L...6..e...........!................&...............................................1.....@.........................`I...1...,.......................R...*......8...................................0...@............................................text............................... ..`.rdata..............................@..@.data....U...........f..............@....rsrc................4..............@..@.reloc...............8..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RHB7P.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):59392
                                                                                                                                                                                                                                  Entropy (8bit):4.406746678775176
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:940258D5363F7197A989D64D85D29BF4
                                                                                                                                                                                                                                  SHA1:CB9793EAFB5EAF1F70ABDBD7814A679362F639D3
                                                                                                                                                                                                                                  SHA-256:220F3F640CF165988561FEA9E2FB828C2D9CA8ED2D943F14B3A6E055F11A4F58
                                                                                                                                                                                                                                  SHA-512:319F10F3EA40312174A8C4B0D9C62E016A881C9C65AD46CEFD0C208D6A8B713D644DC5D8A7C8D2913C1F06181D2AC5C5FE6335633835D91FEBE38CA898CBE707
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]................................qI....@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RNIIR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12288
                                                                                                                                                                                                                                  Entropy (8bit):2.3565212265972675
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C2542D5B306CB4A7F08E09D11E4BD8FD
                                                                                                                                                                                                                                  SHA1:90519D8C6E5211C2088E4B98CCF19A4F501433F2
                                                                                                                                                                                                                                  SHA-256:01A466CE642B71320B7DE37A36FB6FD7E45E339A02A6854E882883BFDEAD42F0
                                                                                                                                                                                                                                  SHA-512:A78753E4FF24D2145DB0FFBDB9B93E0FB4904BE745A3C8CA497F8ACF68B4D03557548B0EA0133ECBD4103058194BC8F6B29E3D36F9842D9CA5B3621328EA21AC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:regfS...S.....f................... .... ......k.u.p.\.O.u.t.p.u.t.\.c.o.m.m.o.n.\.t.o.o.l.s.\.p.x.e.\.B.C.D...I]."@......PV...I]."@......PV.......J]."@......PV...rmtm../............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RU67E.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):294912
                                                                                                                                                                                                                                  Entropy (8bit):5.28716522477778
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3C2A9F3195CDDD8943971DC8A677EF25
                                                                                                                                                                                                                                  SHA1:FE65E384BEF1A26E2968427C02D246FA87FF2B75
                                                                                                                                                                                                                                  SHA-256:28C47B5017260EC82AE70456455953F6DEAC2D6B6590CEC206F9AB8C5D3FDE50
                                                                                                                                                                                                                                  SHA-512:0A5049B3FF5EFA18E4EAB9BD30537C531999AEF7CE1B6A4967CD43D0124D781D2DD665F42FCCE6ECAD22F131571126BFCA74BD0D55F8489EA043F01920AFB879
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r&..6G..6G..6G..??@.?G..??Q.$G..??F.?G..6G...G..??V.RG......7G..??A.7G..??D.7G..Rich6G..........PE..L.....[J.................>...B.......$.......P.......................................]....@...... ...........................?..d....`..........................@.......................................@...x...X....................................text...|<.......>.................. ..`.data...4....P.......B..............@....rsrc........`.......F..............@..@.reloc...............b..............@..B..[J(...o.[J5.....[J@...~.[JJ...........KERNEL32.dll.msvcrt.dll.ntdll.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RV55T.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18112
                                                                                                                                                                                                                                  Entropy (8bit):7.130096168315439
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:68AAF65EC761F8AC0E98DDC68A9A5E5D
                                                                                                                                                                                                                                  SHA1:86A5E5D1C10DC81F0C5B4C11F45DD26A66240CA9
                                                                                                                                                                                                                                  SHA-256:1387A4A748AA91C94C7605BB4A72F29C0AF6F3BC68C11E4B1CDC2E2DFE07E45D
                                                                                                                                                                                                                                  SHA-512:3B55CF4F47CD2477B880764B94646E65F1A54A8011DC75D5C38235AFD46F53F9D8C8410E70D20A89F019C2776CED0E5B592C390EF778A86CAE660ED4B0800A00
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L...^*oX...........!......................... ...............................0...........@.......................................... ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@....^*oX........A...8...8.......^*oX........d...|...|...RSDS.B...p.F..... ......api-ms-win-core-errorhandling-l1-1-0.pdb............8....rdata..8........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........oX....N...................$...@.......................F.......w...................*...k.................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseException.kernel32.RaiseException.SetE

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-RVMPC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):3429376
                                                                                                                                                                                                                                  Entropy (8bit):6.4484191044557555
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0FF97286890816FE8551356BD08786F1
                                                                                                                                                                                                                                  SHA1:D38A6E7AB634892A4B6CA86DE2A3A31368AB35CB
                                                                                                                                                                                                                                  SHA-256:3FDEB94E5D3DE9A88DF75121E0B8DDC1E6969F609FACCF8DA024C267D00ECC5C
                                                                                                                                                                                                                                  SHA-512:376EDE4A02A11DBC0C1E12B199E0477A028F14640DF086D12949E66850D1032A788F25FFD38626C444DFF98C07EE1DBB86233C0C9143F61B47E6ED764B4C511F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..9r..jr..jr..j{..jv..j .k`..j .kx..j .ks..j .kv..j..kp..j..kq..jr..jV..j..ks..j..ks..j..Bjs..j..ks..jRichr..j........................PE..L...o~@`...........!.....^..................p................................4...........@.............................0...@.0.......3.......................3.Lw......T...............................@............p...............................text...u\.......^.................. ..`.rdata..~....p.......b..............@..@.data........P1......:1.............@....rsrc.........3.......2.............@..@.reloc..Lw....3..x....2.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-S91PS.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):19288
                                                                                                                                                                                                                                  Entropy (8bit):4.356706734654434
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3C89BBA00D0000E102F3AF0A3A0BC1C3
                                                                                                                                                                                                                                  SHA1:6C97C879E10BFDEA7DEA07BEE7C194557CCA3C9A
                                                                                                                                                                                                                                  SHA-256:E9AA74AF680361C857A1F9FBFD960029BB22D2F00AAF7926BBB100EA459A2E87
                                                                                                                                                                                                                                  SHA-512:481619939707EBD2F2DF79A7B04D532B096F9A198B535B1CFD0DAFEA6F907095DF41A82DA9906283290FA844006EA279A02A37AF4573F62582F6BAF5181BCFD4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.;G..U...U...U.......U...T.%.U.......U.......U.......U.......U.Rich..U.................PE..L....).P...........!......... ...............0............................................@..................................P..<....`...............@..X....p..X... 5..............................`5..@...........,Q...............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....idata.......P.......2..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SAEB2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):28168
                                                                                                                                                                                                                                  Entropy (8bit):6.779842241520538
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:47BBCA4D9ADCFB1799A28D22AF556BE2
                                                                                                                                                                                                                                  SHA1:E6221162F563E1EE2B3C1EDD6E352D6EF0FF1D87
                                                                                                                                                                                                                                  SHA-256:600B38A0E283F40B79228E4AB1948A1B55080517247C519078F2A06FDAA9F6FD
                                                                                                                                                                                                                                  SHA-512:B7BA410FC61D64EE535033C1DCFFF5B28EA1E8632D289C41BFFC3E420CCCE79608E2F6136B65E6843F11D9D7A0BFF510B9215D20D330B5003A6FC65F39B47890
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a..a..a......a.....a.....a.....a.....a..`...a.....a.....a.....a.Rich..a.........PE..L......e...........!....."..........C).......@............................................@..........................O..g...(H..P....p...............D...*......L...0A..............................XC..@............@...............................text...+ .......".................. ..`.rdata.......@.......&..............@..@.data........`.......8..............@....rsrc........p.......:..............@..@.reloc..b............>..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SCAQ1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):153096
                                                                                                                                                                                                                                  Entropy (8bit):6.318950731674817
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:17DD0A421EBAEF6BED37B2FECC1D0309
                                                                                                                                                                                                                                  SHA1:4F205B6D54C6FEE497121D917F872361F6BC6610
                                                                                                                                                                                                                                  SHA-256:C1B7C011341CA89CC78A886EBD9B35035A3303DC1899BB79E1BC9960A31EBE24
                                                                                                                                                                                                                                  SHA-512:744AAD4DD58C65948068564FBEE4B78B320FDE054DB20AF1E78EDB59B5A5B8CBA286F8F6AFBA8CFD75FB761941AF8A8103BADBF422F909AC76B036765B2FCA22
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I.............f}......v.......v.......v.......v......=.%.............Hw......Hw......Hw......Hw......Rich....................PE..L...|q.e...........!.........x......x........................................`............@.............................L............@...............,...*...P..........p...........................`...@............................................text............................... ..`.rdata...].......^..................@..@.data...d....0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-SUS9J.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):255496
                                                                                                                                                                                                                                  Entropy (8bit):6.239788335825262
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6BC1F92172552129B997E823A0495CA8
                                                                                                                                                                                                                                  SHA1:B2CD1D2CD68B1A2CC31E621A8AE91CF061036F70
                                                                                                                                                                                                                                  SHA-256:E97C4B635009F4E2C6F050E3B1419B539FCA88249F83F96684D0FA71E2894CEF
                                                                                                                                                                                                                                  SHA-512:229506E1E3083EFE8148167AED73915037C030D58DA87D409AE755B2FB39B82B8713D85059ECD62ADE48E4F8B5C89D6F25C100C97D071CA86E6235A275C049C9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..V..V..V.h....V.....V.....V.....V.....V..W.o.V.....V.....V.....V.Rich.V.................PE..L......e...........!.....v...B.......^..............................................x.....@......................... ....................................*...........................................T..@............................................text....t.......v.................. ..`.rdata...............z..............@..@.data...............................@....rsrc...............................@..@.reloc..z&.......(..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-T63TT.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):30216
                                                                                                                                                                                                                                  Entropy (8bit):6.69601435767896
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3B009DBB38F092D0337C817007A074DA
                                                                                                                                                                                                                                  SHA1:AD705E146B66126860577BB001D00BDC8601970E
                                                                                                                                                                                                                                  SHA-256:18D6F8AB7E42CCA24D7B553973374B24B18CE0F6FE9588EC8CE42EFA845D03C3
                                                                                                                                                                                                                                  SHA-512:4E199B8A64C9B8A035706E45917316F0A7D6317192007C7839147E15A8B371DDCBDD99FA0F842D696BEF784F4315344103727AEA53E071FD7663872853FF33F3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................n.......x...............h...............q.......i.......j.....Rich............PE..L......e...........!.....(... .......1.......@.......................................7....@..........................Q..c....J..x....p...............L...*..........@A...............................H..@............@..,............................text...1'.......(.................. ..`.rdata.......@.......,..............@..@.data...p....`.......B..............@....rsrc........p.......D..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-T68SM.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):28754
                                                                                                                                                                                                                                  Entropy (8bit):4.968853820677866
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:37FD55F8EFAB63059A754E4EDF689E1C
                                                                                                                                                                                                                                  SHA1:7A580EF42CEC64AADC4F1501208B9F985178366C
                                                                                                                                                                                                                                  SHA-256:82DD3AE435A5E23ADFF312D2F77F1657F5015EF9E91DEAAB24C8B36FEF2EE3D5
                                                                                                                                                                                                                                  SHA-512:7B03008FFD048BACC2E50CAAB5E4C37CEEB5127EE6D97422D9A9D529110F8F7DDDE8BA2A016E369312BADDE165F64B415B705C8686C35D4D13225A58670E34F4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<EASEUS>.. <GROUP default="Yes" name="Video" icon="../res/video.png">.. <EXTEND default="Yes" name="3G2" icon="../res/iconView/3G2.png" comment=""/>.. <EXTEND default="Yes" name="3GP" icon="../res/iconView/3GP.png" comment=""/>.. <EXTEND default="Yes" name="3GP2" icon="../res/iconView/3GP.png" comment=""/>.. <EXTEND default="Yes" name="AMC" icon="../res/iconView/AMC.png" comment=""/>.. <EXTEND default="Yes" name="ASF" icon="../res/iconView/ASF.png" comment=""/>.. <EXTEND default="Yes" name="AVI" icon="../res/iconView/AVI.png" comment=""/>.. <EXTEND default="Yes" name="CDDA" icon="../res/iconView/CDDA.png" comment=""/>.. <EXTEND default="Yes" name="DIF" icon="../res/iconView/DIF.png" comment=""/>.. <EXTEND default="Yes" name="DV" icon="../res/iconView/DV.png" comment=""/>.. <EXTEND default="Yes" name="DVR-MS" icon="../res/iconView/DVR-MS.png" comment=""/>.. <EXTEND default="Yes" name="FLI" icon="../res/iconView/FL

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-T9U8D.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):25320
                                                                                                                                                                                                                                  Entropy (8bit):6.471829854754283
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:221B7E46EBBBCA5ECAABF2B3D02BDB7D
                                                                                                                                                                                                                                  SHA1:0B5DBE78A80BBB5D8793AAC1E52DAA2A31228348
                                                                                                                                                                                                                                  SHA-256:3DEB0C0EBD6A66AB0E053E62125756E32F3755B7D69AC8F91DDAFCE8D4854EA9
                                                                                                                                                                                                                                  SHA-512:D7019F3E18C5CD121087DB24A3B1FBEDB50FD81F9D281C0E23C37B6789657E4663280D9CA900B53161CBC4A18290D92DDEE540901E6DBD62D506EA18CC27B0A7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h..b;..b;..b;;..;..b;...;..b;...;..b;...;..b;...;..b;..c;..b;...;..b;...;..b;Rich..b;........PE..L......\................. ...$.......%.......0....@.................................W.....@.................................p:..x....`...............H.......p......p1..............................03..@............0..L............................text...w........ .................. ..`.rdata..f....0.......$..............@..@.data...D....P.......<..............@....rsrc........`.......>..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TBEMF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):219144
                                                                                                                                                                                                                                  Entropy (8bit):6.474526671496966
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F582E095DFD2B0AB8AD780A6E1C485A1
                                                                                                                                                                                                                                  SHA1:21B26BFC7B5D83E9D5A0FDDF991BBD1AD2A556EC
                                                                                                                                                                                                                                  SHA-256:E54B49072B60436BD9F7D946E112C5BFD562988CE4064792231BCBD12D4C00CB
                                                                                                                                                                                                                                  SHA-512:FBF2F50574A23B66176E26B431C712787C7169135753125D9C0623DEBB4ED22956F14B1020C037E9C44197FAC7DF1A680FB0FF7736BFD0D95F4553FF252F8A1D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n...*t.]*t.]*t.].;"]+t.]#.!],t.]#.7]$t.]#.0]#t.]#.']!t.]*t.].t.]#.>] t.]#.&]+t.]#.%]+t.]Rich*t.]........................PE..L...V..e...........!................^........................................`......].....@.............................f.......x....0...................*...@......................................x...@...............\............................text............................... ..`.rdata..V...........................@..@.data........ ......................@....rsrc........0......................@..@.reloc..T....@......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TC1KM.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):112
                                                                                                                                                                                                                                  Entropy (8bit):4.792952334335976
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AA96C13A3AB780BD84C93265ACA7FC87
                                                                                                                                                                                                                                  SHA1:7FDE9E5E6AC580E7A5552403DF2080BFB3509C8D
                                                                                                                                                                                                                                  SHA-256:FF5AC96C63F9E41FFDE50DA4B20C3E5DF83396AC8548144EAA49C379DC7DD564
                                                                                                                                                                                                                                  SHA-512:3D692D5AED054F260B11D13E41773953D0701571B4B45FE23F9691329FD94246E65AACF8C5BB4EB9D0A14F38FA8F4C92A85232657DEDADB909C4E08E868EBFA8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>..<CloudNode>.. <Items>.. </Items>..</CloudNode>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TH43L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):61960
                                                                                                                                                                                                                                  Entropy (8bit):6.503915684478268
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:432D55D80CD877323D3CECFDB2CFB12D
                                                                                                                                                                                                                                  SHA1:08726FC23FD1DB8483D420CCF300B66DF584E4E7
                                                                                                                                                                                                                                  SHA-256:9D8A68488C1842589AEEC01183F0701EB563D19010A9DA3268FB4F630EFE9187
                                                                                                                                                                                                                                  SHA-512:047A12D68B4EC9B870B25FA9A0E1D0A957FA989ABE547BCF382F9475AD3B750DCF90EE6EE0165738924457B319EDA39975AA3AC82CF033402460D05B751DA3B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y..y..y...4.{..p.7.{..p.!.w..p.&....p.1.~..y..E..p.(.n..p.0.x..p.3.x..Richy..........................PE..L......e...........!.....f...^.......j....................................................@.............................W...$...P........................*..............................................@............................................text....d.......f.................. ..`.rdata...*.......,...j..............@..@.data...|#..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TJRMJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):111112
                                                                                                                                                                                                                                  Entropy (8bit):5.846121012209598
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:61AADE7125B1FDCB94CB94212D4665FF
                                                                                                                                                                                                                                  SHA1:DDE0B006D9D83C8BD95C666ADE536C11BB949473
                                                                                                                                                                                                                                  SHA-256:F02381B4887C31817D6569ED340DC467CDA7EAC7213CD74A1243DA5F7E01812C
                                                                                                                                                                                                                                  SHA-512:6567962B3EED9CFE808500EE9878E455202C4F33961AB161B2C928EC3EE4485B51DB88092BE7D10AD409632E5909B774110AFECA7FD4AC42BA4C57F86F7C1A9D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6-.BWC.BWC.BWC.K/.bWC.K/.RWC.K/...WC.K/.KWC.BWB..WC.K/.@WC.\..CWC.K/.CWC.RichBWC.........................PE..L...z..e.................r........................@.................................,.....@.....................................P.......@................*..........p..................................@...............4............................text...,q.......r.................. ..`.rdata..j(.......*...v..............@..@.data...............................@....rsrc...@...........................@..@.reloc..b............t..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-TT6IV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):835592
                                                                                                                                                                                                                                  Entropy (8bit):6.46831759140352
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6FFAE28C57C8F98CD38B902850B0FF8F
                                                                                                                                                                                                                                  SHA1:ABA9F097C03DF3872E703A4C9B079459AE447177
                                                                                                                                                                                                                                  SHA-256:C42A5C51F676A4521C1AAE499433F1A485BEC84E0BC586EFAF46E8FA721D6959
                                                                                                                                                                                                                                  SHA-512:F6FA28950BED49399B4F8D616EEE65080FD03AFFB916AC47A2D22C4DA12A11EF5BC2C29F88417F107B1CF320EA2468DF53590782CD5F6AB5A15E5594F586DA91
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......5...q...q...q...x.E......n..p...#...}...#...v......s...#...Q...#...u..............u.......x...q...d.......p......R....).p...q.A.p......p...Richq...........PE..L..._..e.................V...<...............p....@..................................t....@..................................^.......@..(................*...0.....`...T...................X...........@............p...............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data........ ......................@....rsrc...(....@......................@..@.reloc......0......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-U0Q12.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):79880
                                                                                                                                                                                                                                  Entropy (8bit):6.458330049333086
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A9FB66DA6A97FFB516C21AC139C5E546
                                                                                                                                                                                                                                  SHA1:E8935527713E7C7FC57C376AB9780D794A862934
                                                                                                                                                                                                                                  SHA-256:D2DFC97F2B2641775DFC500FB0A27AABD2C067D5DFECA6CE4576D594C3298715
                                                                                                                                                                                                                                  SHA-512:BF670494BB21B1D83478AD6978A96DBF5FE57C968E51770018D25E6CD02C93DF9EA32ACCD5DE5FADD7A22C94D9380658B5F9720D9CDD0F7AC8627EB2ACB240A0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z...;...;...;...t/..;...C,..;...C:..;...C=..;...C*..;...;...;...C3..;...C+..;...C(..;..Rich.;..........................PE..L...h..e...........!.........Z......y........................................P......N.....@.........................p...n............ ...................*...0..........................................@............................................text...u........................... ..`.rdata...6.......8..................@..@.data...............................@....rsrc........ ......................@..@.reloc..&....0......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-U53AK.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):774664
                                                                                                                                                                                                                                  Entropy (8bit):6.112345161393828
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:35AC9DA85A0190D58F7117ECA644E224
                                                                                                                                                                                                                                  SHA1:F42AACD362265195FB9B8039AE9C27A04DA61BC9
                                                                                                                                                                                                                                  SHA-256:B3C9D1027E4DB9D03B92E0427834718D8561BF73175D5E3D7E108AF746C02785
                                                                                                                                                                                                                                  SHA-512:002B1D6306E74A305328CFF76B5A80BD4522D0FDEF94324A668D68D7BAE08C748E8DCD7DD9B7627C219CD0B9D1F8EF9F7E1DED72EED0D4B2DA8199D1D8F148C4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K..k%..k%..k%.z$...k%......k%......k%......k%......k%..k$..k%......k%......k%......k%.Rich.k%.........PE..L......e...........!.....H...\...............`............................................@.........................0.......x............................*.......9..Pc...............................C..@............`...............................text....G.......H.................. ..`.rdata...k...`...l...L..............@..@.data...............................@....rsrc................\..............@..@.reloc...G.......H...`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UHBJV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):332808
                                                                                                                                                                                                                                  Entropy (8bit):6.035173540228579
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6EAC223AA1E5C67B12B487A79DDE6BC3
                                                                                                                                                                                                                                  SHA1:6E19F9E90C82D166165631B3E0BC5C644195608A
                                                                                                                                                                                                                                  SHA-256:853C1F9F9E19DFF3E52C7A4588975470DCF1F79027618F49A1DDC3E1273C8BD9
                                                                                                                                                                                                                                  SHA-512:D710796EADA1855D3629871709DC5A8E766175C87B5DF02E2F8263FD80A391218CF7EE660DC7483B81F4202D987D67F98EAE1F3F807BACAC4309CB7345B209DE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3]0.w<^.w<^.w<^.in.r<^..s.t<^.~D..<^.~D.~<^.~D.`<^.~D.f<^.w<_.~=^.~D.c<^.~D.v<^.~D.v<^.Richw<^.................PE..L......e.................$...................@....@.......................... ...........@......................... ...h................................*..........0D..............................0/..@............@...............................text....".......$.................. ..`.rdata...o...@...p...(..............@..@.data...............................@....rsrc...............................@..@.reloc...<.......>..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UKT53.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):128008
                                                                                                                                                                                                                                  Entropy (8bit):5.7997678739147736
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8A14E37E44BB0E75A0958D23546A2628
                                                                                                                                                                                                                                  SHA1:BBADC2135AB92C943799A47F2B3BCA126FA490FD
                                                                                                                                                                                                                                  SHA-256:CE869D65FF27FEFB75B094F4F1B79CB4858EE8C052434F805B0C2CB47C582E44
                                                                                                                                                                                                                                  SHA-512:760664A04EF967C2D23A9646578C40282C2049FB9908F473B62ABC64EB33176F600A8F792BCB4483ED342F91061C9C6C27C7380504C6488FCA9589390D1C3B6D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..!*.r*.r*.r#..rd.r#..r .r#..r..r#..r#.r*.rY.r#..r..r4..r+.r#..r+.rRich*.r........PE..d......e.........."..........*.......3.........@....................................-z....@.................................................t...d....0..H.... ...........*..............................................................8............................text............................... ..`.rdata...?.......@..................@..@.data...x'..........................@....pdata....... ......................@..@.rsrc...H....0......................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UT1SD.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):35336
                                                                                                                                                                                                                                  Entropy (8bit):7.067615302463738
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2ABA8C5230724D2B994527DAF410EB46
                                                                                                                                                                                                                                  SHA1:C6EBAD3695B38E8A1C482F953FF825743919B1CD
                                                                                                                                                                                                                                  SHA-256:E532343E6A3D522A1740E205560DCECF013B4D7472BA7D0DA40659E5CA9AAE38
                                                                                                                                                                                                                                  SHA-512:83903E0B15607F3675EFD45AB90A2FE0E9F7ACE273A180853C0EB5385AE777C6E8E47D0A06CF78237D641A9551031612EEF104EA6DE45F3EE0449CB6CEF4DF4D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.d*=..y=..y=..y4..y?..y4..y0..y4..y?..y4..y:..y=..y...y4..y8..y4..y<..y4..y<..yRich=..y................PE..L......e...........!.........>......y(.......0............................................@..........................V......\R..P....................`...*......,....0..............................HQ..@............0...............................text............................... ..`.rdata..-'...0...(..."..............@..@.data........`.......J..............@....rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-UV3HJ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):923144
                                                                                                                                                                                                                                  Entropy (8bit):6.274219696652033
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5C808F9A8700F53B20CE3692B38ACC64
                                                                                                                                                                                                                                  SHA1:4B6151749EE5952D054DE9A20FE71484E9E896D6
                                                                                                                                                                                                                                  SHA-256:33CB57794A67C7F8D1AA165F27D06B78EDD6A835BB752DAD93061E43485F9755
                                                                                                                                                                                                                                  SHA-512:C6B7FBD2026EF12168283BDAD533BC4516BF8F490F767CE647FAD47D61EF1B9A49F15434FF90EE4D647FBC7ADC764FF757A0CF36A3EF65CC746CF2711BEEE189
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q&.T5G..5G..5G......0G..<?..>G..<?..:G..<?..<G..<?..*G..5G...F..<?...G..<?..4G..+...4G..<?..4G..Rich5G..........PE..L......e...........!.....p...x...............................................@.......9....@..........................K......d...@........................*.......g..................................`~..@...............d............................text....n.......p.................. ..`.rdata...............t..............@..@.data... ]...P...(...@..............@....rsrc................h..............@..@.reloc...z.......|...p..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-V9270.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18624
                                                                                                                                                                                                                                  Entropy (8bit):7.07690941790109
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A8B527FA19DA868DDE67C429398ADDC0
                                                                                                                                                                                                                                  SHA1:7CA13408565890F1F96CE838C818F2FE4B8B5A7C
                                                                                                                                                                                                                                  SHA-256:1F62695F9FB0FC6FECA4283BB4BE26EEEA1C5F10368AD51C8A5D910D3E105188
                                                                                                                                                                                                                                  SHA-512:18C9A578BAA8CAC20F0610C0939FE69638B00DE09E9CEBA72DA4801277C64EAB1C7AE12DA63E087BFE2361B4454229A7C68983D0D30F82FC4E82AA2BF23E33F2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.d.c.d.c.d...d.b.d...`.a.d.....b.d...f.b.d.Richc.d.PE..L....0oX...........!......................... ...............................0.......9....@............................."............ ...................<..............8............................................................................text............................... ..`.rsrc........ ......................@..@.....0oX........>...8...8........0oX........d...x...x...RSDS......H..Z..(O.....api-ms-win-crt-environment-l1-1-0.pdb...........8....rdata..8........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02..............oX........................P...............4...O...j...........................<...Y...v...........................*...G...`...}.......................1...P...k.......................................................api-ms-win-crt-environment-l1-1-0.dll.__p__e

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VEDLT.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):875528
                                                                                                                                                                                                                                  Entropy (8bit):6.470303020374
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:50625820FA566539B7E4ADDE9CD447F6
                                                                                                                                                                                                                                  SHA1:5CBDA693D6C1963D1DFBA355C7C25D1099A029B3
                                                                                                                                                                                                                                  SHA-256:62DF0E3F928F58A78A9C50582EA40F514686FC094C909B2A9C99AE6A139159FA
                                                                                                                                                                                                                                  SHA-512:E8439E0235381607F9ABA222DF6A27F3A9B65DBD05D9A2C7648528B156ADD0758B941343AE1405BBD507F3EC04F16CBC89C18A1F2EFF60748B3EE2370D9F875A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......0.k.t...t...t...}...d....j.u...&...x...&...s......v...&...T...&...p.......z......p......}...t...6......R......u...t..u......u...Richt...................PE..L......e.....................p....................@..........................P......e.....@.................................h...........(............2...*......@.......T...............................@...............d............................text............................... ..`.rdata.."...........................@..@.data...............................@....rsrc...(...........................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VKD48.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):822792
                                                                                                                                                                                                                                  Entropy (8bit):6.469822931074252
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1604F6AD002904C7E59C068EC54E534A
                                                                                                                                                                                                                                  SHA1:12253B0F45A10761F9EBDB76A2E4D1A1EB582374
                                                                                                                                                                                                                                  SHA-256:11D68120D59F48EEFA9EEC1F6212971443DE17196E3BC08E61A6EB88CE41A8B3
                                                                                                                                                                                                                                  SHA-512:7C4538AC486AFC49DDD1D7FA19C7047BC53701361A77C3D0E72A132EDC026288CE7B373C7785899C25DB99FC0EB657917B0FB8705F539141469914CDC534BA6C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......%5..aT..aT..aT..h,%.oT....q.`T..3<..mT..3<..fT...=..cT..3<..AT..3<..eT...0..oT...=..eT...$..hT..aT..kP...$..`T...=..@T...=I.`T..aT!.`T...=..`T..RichaT..........PE..L...X..e.................6...*.......~.......P....@.................................m.....@................................../..........(............d...*...........Y..T....................Z......(Z..@............P...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data...............................@....rsrc...(...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VKE9V.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):43008
                                                                                                                                                                                                                                  Entropy (8bit):7.67619073966418
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A136C0471245853913CD78B081B379BD
                                                                                                                                                                                                                                  SHA1:7FDF71D167E3B3FAC32955671B6DDFAD214320B8
                                                                                                                                                                                                                                  SHA-256:5C073359C8C0E5B4BE7818F53D3E6157AA1B60C2EF08034558B1775F950CE695
                                                                                                                                                                                                                                  SHA-512:79577013313E2C099753DD8831A8073CEBBC4E2638130AB50BBA9C6D460025B2FB3C08A16A648BD2B21AEC019E0339CCAE558DEB366504639C82D96DF6FBDCDE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........~...~...~....1..~......~......~......~......~......~...~...~..R....~..R....~..R.]..~..R....~..Rich.~..........................PE..L...i.<`...........!.........................0............................................@.........................0...........P...............................t......................................@............0..h............................text...V........................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\is-VP44V.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):436224
                                                                                                                                                                                                                                  Entropy (8bit):6.644166189193798
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3FD874C4C3D8919A3BD009017D31F1F2
                                                                                                                                                                                                                                  SHA1:E3246DBFD0F87A3A4F6124762A8BA3886FFA0FCF
                                                                                                                                                                                                                                  SHA-256:FDB29A26C32C9A5EDAADD57061FE7315BF3E4BE34EC8D74E21678F59144A19B0
                                                                                                                                                                                                                                  SHA-512:3C7ED97DD8A17209A3E70220950AF7E778A45809955827735B622B7B4C52425B7007282730B64823DF4E9E6953D8F7159AD1D2B184CE05DC52418857966F1A4F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ls..ls..ls.Z#...ls......ls......ls......ls..lr.dms.....Tls......ls..>...ls......ls.Rich.ls.........PE..L....^e...........!.....>...f.......G.......P......................................g.....@..........................J.......*...................................9...................................)..@............P..$............................text....<.......>.................. ..`.rdata.......P.......B..............@..@.data........`.......H..............@....rsrc................b..............@..@.reloc...<.......>...j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\jpeg62.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:96995DE4513551D49808B34B40FFB26A
                                                                                                                                                                                                                                  SHA1:1DAF57AAEA01D60BDB7C63FAF18A419DF955E321
                                                                                                                                                                                                                                  SHA-256:F0D0157B4F1F0FA5AA0C4682EC659CE5E1C61585E631A14536BEA10FAF0B01EA
                                                                                                                                                                                                                                  SHA-512:CFD3B3E8250804D4D4C77BD49A3674FF910AC4C401FB21E5F6F6108916248F88971269202BB26D3FFD4AA987008D2DAFD67430D1D55097610B8F907FFB398181
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.B..........."...8..........................lh.........................@................ .................................t............................0.......................................................................................text..............................`..`.data...0...........................@....bss.....................................edata...................................idata..t...........................@....rsrc...............................@....reloc.......0..................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\lang.ini (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A73B4C16CD25E56CBBBE266DC8520255
                                                                                                                                                                                                                                  SHA1:61B586B5178479170E9E3355B53819D8DCA36738
                                                                                                                                                                                                                                  SHA-256:68064B703BAD5D79A901F68975D7A691FFA155E5172B164C5CBB0A4977066864
                                                                                                                                                                                                                                  SHA-512:D1F037E8557AAD32B304A2D9E898CC47496F5C4DD5CD37210EB44D3A729276759ACECD9F7CE8024B4C83025D12BE01274DB562AF53CA3869361BAEE526B68959
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:..[.L.a.n.g.u.a.g.e.s.].....E.n.g.l.i.s.h.=.r.e.s._.e.n._.U.S.....J.a.p.a.n.e.s.e.=.r.e.s._.j.a._.J.P.....G.e.r.m.a.n.=.r.e.s._.d.e._.D.E.....I.t.a.l.i.a.n.=.r.e.s._.i.t._.I.T.....S.p.a.n.i.s.h.=.r.e.s._.e.s._.E.S.....F.r.e.n.c.h.=.r.e.s._.f.r._.F.R.....P.o.l.i.s.h.=.r.e.s._.p.o.l.a.n.d.....P.o.r.t.u.g.u.e.s.e.=.r.e.s._.p.o.r.t.u.g.a.l.....C.h.i.n.e.s.e.=.r.e.s._.z.h._.C.N.....C.h.i.n.e.s.e.T.r.a.d.=.r.e.s._.z.h._.T.W.....K.o.r.e.a.n.=.r.e.s._.k.o._.K.R.....T.h.a.i.=.r.e.s._.t.h._.T.H.....M.a.l.a.y.=.r.e.s._.m.s._.M.Y.........[.E.n.g.l.i.s.h.].....P.r.o.g.r.a.m.O.n.T.h.e.W.e.b.=.V.i.s.i.t. .E.a.s.e.U.S. .o.n. .t.h.e. .W.e.b...u.r.l.....G.e.n.e.r.a.t.e.R.e.p.o.r.t.=.G.e.n.e.r.a.t.e. .r.e.p.o.r.t...l.n.k.....U.n.i.n.s.t.a.l.l.P.r.o.g.r.a.m.=.U.n.i.n.s.t.a.l.l. .%.s...l.n.k.....H.e.l.p.=.%.s. .H.e.l.p...u.r.l.........[.F.r.e.n.c.h.].....P.r.o.g.r.a.m.O.n.T.h.e.W.e.b.=.P.a.g.e. .d.'.a.c.c.u.e.i.l. .d.e. .E.a.s.e.U.S. .T.o.d.o. .B.a.c.k.u.p. .V.i.s.i.t.e.r. .E.a.s.e.U.S...u.r.l.....G.e.n.e.

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\libEGL.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:371AEB50F7816108B346B67EF2B11E1A
                                                                                                                                                                                                                                  SHA1:5DE780B46D7663D1615727EDABA32B5709286D38
                                                                                                                                                                                                                                  SHA-256:12903D93A7F57B479401602A533849E6F813FF5C2C92F3A02D468FC98E7AC1D5
                                                                                                                                                                                                                                  SHA-512:4AFF94ADBD97948766C7839220E15000A4DEFB7D46B5502872B16225E8C5B85B6B674B632455AFBB3DB729D5F2E9666B32B8DB282EA3499EBD84FE4CE11D9631
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u...u...u......u...t...u..t...u...p...u...q...u...v...u.E.t...u...t..u.E.p...u.E.u...u.E.....u.......u.E.w...u.Rich..u.........PE..L....._...........!.........*...............0............................................@..........................5.......>..d....`..H............>.......p.......1..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....rsrc...H....`.......6..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\libGLESv2.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7FF6836C626BBC7F0833A66AA77A7A7F
                                                                                                                                                                                                                                  SHA1:9AD21C1A5DF940999BA9F884D21868D3B69E7155
                                                                                                                                                                                                                                  SHA-256:8CFC024D09A6784486DA7DC0EBFD90C0C8136B27C08EC1C3F352CD4FA43B9273
                                                                                                                                                                                                                                  SHA-512:8FF378B9D2A1058396FF5E9795F7BD25FC3092F94B9274447C849C19294569197F6920BDA448A3E2C06B012BA1468D75F2B26ED1BD4E54191F28CA209BF41697
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M6M.#eM.#eM.#eD..e].#e..'dG.#e.. dD.#e..&dV.#e.."dI.#eY."dJ.#eM."eO.#e.&dC.#e.#dL.#e..eL.#eM.eL.#e.!dL.#eRichM.#e................PE..L....._...........!......"..&......}. ......."...............................,.....;a-...@...........................*..\...l*......0+.P.............,......@+.t....'.T....................'..... .'.@............."..............................text....."......."................. ..`.rdata........".......".............@..@.data.........*......|*.............@....rsrc...P....0+.......+.............@..@.reloc..t....@+.......+.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\libGuiTheme.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2ADF12B81A639F2B4325E3DED91FCC55
                                                                                                                                                                                                                                  SHA1:2642775D87866A2B56507606466147B043FC464A
                                                                                                                                                                                                                                  SHA-256:98AE799CBB9A49CA6B2847FE7AD7E72CE2CDCCCF39CC9B29918B8B3589F7D8A8
                                                                                                                                                                                                                                  SHA-512:4BE63B91D649360AD1B9C2BFD28456D1F76FDF70F8D8EEA99EF93B2365F56A9A51AB3AECA8CF9451474A6076350E508A9AA6B96861493D13C81F592C10A096D6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.@.>...>...>.......>...l...>...l...>...l..q>.......>...>..C>...l...>...l...>...l...>..Rich.>..................PE..L...y.}M...........!.................{..............................................3.....@..........................N......D<.......@.......................P..(,......................................@............................................text............................... ..`.rdata...,..........................@..@.data...HD.......(..................@....rsrc........@......................@..@.reloc...8...P...:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\libcrypto-3.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:13462A0C1B30FEF03C2137891A56A6EB
                                                                                                                                                                                                                                  SHA1:990919E91356632D4710507F4AD7F6FF13DE33E5
                                                                                                                                                                                                                                  SHA-256:DBF83314288394EDBE27E62DCAAB452056184267978D86CCCA5ED0B445651DE1
                                                                                                                                                                                                                                  SHA-512:090B1AFB007F2ED0EAAEC2454D0D3D1206C699DFDAC4E84DABE502B6BFD1C7D40B7F94D915B4F8B3E3F9EDA778B21F23BE17E356ED1CFEBD683883E261DA71DB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.k...8...8...8..~8...8..x8...8..i8...8...8}..8...8...8...8...8..n8...8...8...8.Uy8...8..|8...8Rich...8........PE..L...^.]e...........!.....<'...........&......P'..............................06.....".6...............................0......P4.x....p4.L.....................4..p.. W'..............................0.@............T4.4............................text...1;'......<'................. ..`.rdata.......P'......@'.............@..@.data....K....4..,....3.............@....idata.......P4.......4.............@....rsrc...L....p4......04.............@..@.reloc.......4......84.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\libcurl.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3FD874C4C3D8919A3BD009017D31F1F2
                                                                                                                                                                                                                                  SHA1:E3246DBFD0F87A3A4F6124762A8BA3886FFA0FCF
                                                                                                                                                                                                                                  SHA-256:FDB29A26C32C9A5EDAADD57061FE7315BF3E4BE34EC8D74E21678F59144A19B0
                                                                                                                                                                                                                                  SHA-512:3C7ED97DD8A17209A3E70220950AF7E778A45809955827735B622B7B4C52425B7007282730B64823DF4E9E6953D8F7159AD1D2B184CE05DC52418857966F1A4F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ls..ls..ls.Z#...ls......ls......ls......ls..lr.dms.....Tls......ls..>...ls......ls.Rich.ls.........PE..L....^e...........!.....>...f.......G.......P......................................g.....@..........................J.......*...................................9...................................)..@............P..$............................text....<.......>.................. ..`.rdata.......P.......B..............@..@.data........`.......H..............@....rsrc................b..............@..@.reloc...<.......>...j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\libssl-3.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C8EBECFDD9C8E2EB97D232FC0CE5A52F
                                                                                                                                                                                                                                  SHA1:601837F78F5B2691BC7DBC3F37918044E58E12A6
                                                                                                                                                                                                                                  SHA-256:9B15E4A5B2A63004F6839D55F169755D9BABE76FEB456B7F9A3128513595D3AF
                                                                                                                                                                                                                                  SHA-512:77E4DCE9F6687C75FCFDA483543937B3B638BCCC3508AA94E9344874F6E9ECC5D0E61FF51A8BB29E2C3306D73C9E7D11C8B9C31EF6ADC542FDA91C116DCDC739
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u......................l=......l,......l;..............l+......l:......F<......l9.....Rich....................PE..L.....]e...........!.....\...z......xP.......p......................................y....................................Q...`..P.......D.......................0B.. u.................................@............j...............................text....[.......\.................. ..`.rdata..8....p.......`..............@..@.data....<... ...:..................@....idata...F...`...H...>..............@....rsrc...D...........................@..@.reloc...J.......L..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\libxml2.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E75D9887E0A9A6FBB812B629F8EA0916
                                                                                                                                                                                                                                  SHA1:2457DDDCC5CD945260E2599FFAF367514D156875
                                                                                                                                                                                                                                  SHA-256:82E916EF03117F214BC3E870FEFDDD4FC422854C27BDA75AB272BB0AAC6B7A12
                                                                                                                                                                                                                                  SHA-512:38C1BD7824D8BBC037BFA0696A3064A06C4E53685BE39509BFE3C4F1484691A0BAA3B5A1FFA6244E4E25CA31968C3EA004BA0A8A7EC39EFF2EDC67D1E6384410
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... 0VE...........#...8............`.............Pc.........................0......L......... ..............................p.. ....................................................................................................................text...P........................... ..`.data...............................@....ctors..............................@....rdata...S... ...T..................@..@.bss.....................................edata...............@..............@..@.idata.. ....p......................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\loginHistory.xml (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6144426EB5FBC0B53788720015CDD934
                                                                                                                                                                                                                                  SHA1:38B4A816D1E992EE31BF9D6CDA9FCB1D21F5269B
                                                                                                                                                                                                                                  SHA-256:70544B831CADB45B4881C1F872D27F7BFB36AD13EBE10F21AB84B114F6FA740E
                                                                                                                                                                                                                                  SHA-512:EC8D4FC85193D0C36831E5F90452CBF667F5004B9587ED234411529381110D0A7C7311E718F2AE479ED17CD02A084639AB60976FC5D31FE972C98E26B1C4981C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>..<UserLogin>.. <Items>.. </Items>.. <Recent>.. </Recent>..</UserLogin>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:462DDCC5EB88F34AED991416F8E354B2
                                                                                                                                                                                                                                  SHA1:6F4DBB36A8E7E594E12A2A9ED4B71AF0FAA762C1
                                                                                                                                                                                                                                  SHA-256:287BD98054C5D2C4126298EE50A2633EDC745BC76A1CE04E980F3ECC577CE943
                                                                                                                                                                                                                                  SHA-512:35D21E545CE6436F5E70851E0665193BB1C696F61161145C92025A090D09E08F28272CBF1E271FF62FF31862544025290E22B15A7ACDE1AEA655560300EFE1EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.R."..."..."......"......."......"...p^.."..\m[.."...pX.."...pN.."...pI.."......"..."...!...pG.>"...p_.."...pY.."...p\.."..Rich."..................PE..L....`1G...........!.....T...N......C+.......p....^x................................g.....@..............................f......x.......x................#.......... ..................................@...............@...........................text....R.......T.................. ..`.data....j...p...H...X..............@....rsrc...x...........................@..@.reloc...1.......2...P..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90chs.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FC1F85E5D3F477E8A9351B5A0A9BCDCC
                                                                                                                                                                                                                                  SHA1:226F49DA8FB96313D6C38025F8860BF36AC107C7
                                                                                                                                                                                                                                  SHA-256:5936DD619E57EB295172AD930890478D67FABEFE6EB26997C5706127C5395C15
                                                                                                                                                                                                                                  SHA-512:392B67F0EFCE9254ED2ADDEBB3031C8DE6535127773D83B4101AFCA90E6456F5DE499361B6DAFA78C6EB1BF73DFBEC43355FC598E4D6EFCDBE90C8ABDC96ECDF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!.........|....................6]......................................@..............................................z...........~...$...........................................................................................rsrc....z.......|..................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90cht.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F3C53B5B47AB2D76FE2BBD7B3410FD63
                                                                                                                                                                                                                                  SHA1:21D8AFDF6269233AAFE2AD0C5B04E0CF0D7D1659
                                                                                                                                                                                                                                  SHA-256:416641841917752D9EA6D90FF3D59E1FBF59B5BCFA9F9FFCF2900BFA3C76603D
                                                                                                                                                                                                                                  SHA-512:05569BDDC3A0E48F148865CD501F93CA8CA59C38B5BFF36F75006971FD2B120956E261352F3AE6CC49622CABA936794D355E61ADB6D7106408DA0AC933B4FFF3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!.........~....................6]......................................@..............................................}...............$...........................................................................................rsrc....}.......~..................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90deu.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:03F005368955CD4B005B1BF8CA592F7A
                                                                                                                                                                                                                                  SHA1:D5F3BF58A262D969C02EE7E590AEA293B8329C75
                                                                                                                                                                                                                                  SHA-256:0A05BE79A6D3FB023001426B56A9D7A76D7DDEA900FB4D6A762E42E4BF510925
                                                                                                                                                                                                                                  SHA-512:6D99FACEFAD9E9E57AC4EEEA4B505DA39EC21EAAE69AAFD3865D937432FB378A440F8A7C9E27DC37EE3BFC375CFCFFC846EE85D4FFC6D053B8B5FEE68927B0DD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]......................................@.............................................`................$...........................................................................................rsrc...`...........................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90enu.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3BE57351529E0F2BA7742CDF2B05316B
                                                                                                                                                                                                                                  SHA1:61102D15DC8A80B84CBEF5807B3573F09EDD5E0C
                                                                                                                                                                                                                                  SHA-256:A3E2C202E556791DEE9D18962CA6780761B415313BCD104C2E621BA4089801A4
                                                                                                                                                                                                                                  SHA-512:F44BC0496A0DACBA04C4CFA8050109B946A0F3158FD544F7D45841013FF394338793C9EA6BDAD1095AB5A837451F00C595C640287AD5E12F408CEEBCE4A226B0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]......................................@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90esn.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9BFF4F740C98EA1D881D94512B08013C
                                                                                                                                                                                                                                  SHA1:D8850F329ED0DE8EBEFC1CC77CC0621C31EF488B
                                                                                                                                                                                                                                  SHA-256:6AF004041FDFC158616DCC40A26853AC82F0D70F03FB4EED2E15FFFAB01551CF
                                                                                                                                                                                                                                  SHA-512:4641361CE0FB9A33C10C6C4D9FE447FFF925693357C129D2A643A3589E1A8F43ED3DBF55ED0EC685BBE634DEB9C86E8E03762C2AD21669DB13D763864C946E31
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]......................................@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90esp.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EEB0A4CC976A8D732EB1168514C77236
                                                                                                                                                                                                                                  SHA1:FEF206C7750C2CA1F4DF1C74F4868A700F83F747
                                                                                                                                                                                                                                  SHA-256:A7FE95E7FC7420A12A71D9AEE57130ADEFD3AFC3017EB98BCFCB509B2F2AF1BF
                                                                                                                                                                                                                                  SHA-512:F3ED5A509618A3B6ADC62A8032047C5255EE4B4AB42E349B8BF03D903C5D85F8EFD915BE6039D13E7A67099650C2BE480A7AAA57FA8BC8BABDCF5B8D3DAAB2BB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]................................\.....@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90fra.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:07F20E09C028F0E5469CA8EB782724DE
                                                                                                                                                                                                                                  SHA1:8F3BD4C2D6133AD3C3BC9C1ECD33EB4BB73E4BE4
                                                                                                                                                                                                                                  SHA-256:996E42DDBEBA26F92F33338CCC8E3B2FAC91D70DED4C311C7A64C6850A7B2F0E
                                                                                                                                                                                                                                  SHA-512:E2664CE3D90F5ADB4BD81722BC42D6AE450AAEDDC5F66356E5BF3E63206820655C1A83068B075B07E62F0D83F9E17F187F5397D3576A684F205B8F8B1A79697C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]......................................@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90ita.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:940258D5363F7197A989D64D85D29BF4
                                                                                                                                                                                                                                  SHA1:CB9793EAFB5EAF1F70ABDBD7814A679362F639D3
                                                                                                                                                                                                                                  SHA-256:220F3F640CF165988561FEA9E2FB828C2D9CA8ED2D943F14B3A6E055F11A4F58
                                                                                                                                                                                                                                  SHA-512:319F10F3EA40312174A8C4B0D9C62E016A881C9C65AD46CEFD0C208D6A8B713D644DC5D8A7C8D2913C1F06181D2AC5C5FE6335633835D91FEBE38CA898CBE707
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]................................qI....@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90jpn.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:90C9666E1F1BB578C35C26CFCE10E2D8
                                                                                                                                                                                                                                  SHA1:B2D0E230E4D03ECD0D7F503DBED75142331C6353
                                                                                                                                                                                                                                  SHA-256:6B6259B876972EB7507D052D4EAC068555BEA6973643DB7050C6606D46BEECA7
                                                                                                                                                                                                                                  SHA-512:075ADB3657FDE64347DF20208E73187211A181CD83186F3EEFE9B797DA2706B9C4F40FE2C3AA2C61C0D5AB14461A630EB0E3DFB4D189AB7238AB6B43727126A8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]................................W+....@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90kor.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5017F29E77552C1A34CD4D835362CDD7
                                                                                                                                                                                                                                  SHA1:EBA31791876F3B7DBAA08606AA1F72944C10FB04
                                                                                                                                                                                                                                  SHA-256:3BAEC8E203787CCA2C7E6D106D92859BE6496E03AD70318167FF729472814B3D
                                                                                                                                                                                                                                  SHA-512:7E5B34776D46DA900B4266EC3BA30F736352CD2C1B80AB7E4E126A6D41AA1507973EF2134C24CF36B2EF6AF9BBE756318AA0DD8EAC00F4DEDDE152E32714CB25
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........|...|...|.......|.......|..Rich.|..........................PE..L....`1G...........!..............................6]................................O.....@..............................................................$...........................................................................................rsrc...............................@..@....................................................P...............................p...............h.........................&.....................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P.......h... .......!.......".......#.......$.......%.......&........................y..(....y..@....~..X....................x..p....x.......x.......x......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfc90u.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B9030D821E099C79DE1C9125B790E2DA
                                                                                                                                                                                                                                  SHA1:79189E6F7887CA8F41FB17603BD9C2D46180EFCF
                                                                                                                                                                                                                                  SHA-256:E30AABB518361FBEAF8068FFC786845EE84ABBF1F71AE7D2733A11286531595A
                                                                                                                                                                                                                                  SHA-512:2E1EBCBE595C5A1FE09F5933D4BA190081EF343EA313725BB0F8FCBF98079A091AB8C0465EF437B310A1753FFC2D48D9D70EC80D773E7919A6485EF730E93EA1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...~H.X......X...~H..I...G.>.[.....;.X...G.8.R...G...F...G.).P...~H.P...Y...;...G.'.....G.?.X...G.9.X...G.<.X...RichY...........................PE..L...*`1G...........!.....j...P......a@.............x.................................x....@.........................P....g......x........................#......h.......................................@...............<............................text...kh.......j.................. ..`.data....l.......J...n..............@....rsrc...............................@..@.reloc...1.......2...h..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfcm90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D4E7C1546CF3131B7D84B39F8DA9E321
                                                                                                                                                                                                                                  SHA1:6B096858723C76848B85D63B4DA334299BECED5B
                                                                                                                                                                                                                                  SHA-256:C4243BA85C2D130B4DEC972CD291916E973D9D60FAC5CEEA63A01837ECC481C2
                                                                                                                                                                                                                                  SHA-512:4383E2BC34B078819777DA73F1BD4A88B367132E653A7226ED73F43E4387ED32E8C2BCAFD8679EF5E415F0B63422DB05165A9E794F055AA8024FE3E7CABC66B9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...X`1G...........!.....:..........rG.......P.....x.........................0............@.................................L................................ .......R...............................S..@............P..,............R..H............text....8.......:.................. ..`.rdata..^....P.......>..............@..@.data...............................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\mfcm90u.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:371226B8346F29011137C7AA9E93F2F6
                                                                                                                                                                                                                                  SHA1:485DE5A0CA0564C12EACC38D1B39F5EF5670A2E2
                                                                                                                                                                                                                                  SHA-256:5B08FE55E4BBF2FBFD405E2477E023137CFCEB4D115650A5668269C03300A8F8
                                                                                                                                                                                                                                  SHA-512:119A5E16E3A3F2FF0B5ACB6B5D5777997102A3CAE00D48C0F8921DF5818F5FBDA036974E23C6F77A6B9380C6A1065372E70F8D4E665DFD37E5F90EB27DB7420C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...Y`1G...........!.....:..........rG.......P.....x.........................0......Ko....@.................................|................................ .......R...............................T..@............P..,............R..H............text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...P...........................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\msvcm90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4A8BC195ABDC93F0DB5DAB7F5093C52F
                                                                                                                                                                                                                                  SHA1:B55A206FC91ECC3ADEDA65D286522AA69F04AC88
                                                                                                                                                                                                                                  SHA-256:B371AF3CE6CB5D0B411919A188D5274DF74D5EE49F6DD7B1CCB5A31466121A18
                                                                                                                                                                                                                                  SHA-512:197C12825EFA2747AFD10FAFE3E198C1156ED20D75BAD07984CAA83447D0C7D498EF67CEE11004232CA5D4DBBB9AE9D43BFD073002D3D0D8385476876EF48A94
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...`...`...`..{`...`..~`...`..}`...`.@.`...`.j.`...`...`<..`..k`...`..l`..`..z`...`..|`...`..y`...`Rich...`........PE..L....=1G...........!.....:...................P....?x.........................0.......L....@..........................1..4....%..d...............................d...P...............................P...@...............(...........p...H............text....8.......:.................. ..`.data...|....P.......>..............@....rsrc................H..............@..@.reloc...!......."...L..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\msvcp140.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1FB93933FD087215A3C7B0800E6BB703
                                                                                                                                                                                                                                  SHA1:A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
                                                                                                                                                                                                                                  SHA-256:2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
                                                                                                                                                                                                                                  SHA-512:79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\msvcp140_1.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CB8E791FAF8A711F9863F759F37FD316
                                                                                                                                                                                                                                  SHA1:AB7A1A33574364D8BFBEACE46BDA3C8192FAF379
                                                                                                                                                                                                                                  SHA-256:F1EFC4A0F0AEF50477FC979642A51B1CDCD23C689F98AFA9F5A039F5F05904F0
                                                                                                                                                                                                                                  SHA-512:30A30FFCB3514649D2AA747D4036EEF50DBFD986D1BF8E5E855F74A5C55DB61C4D77444378EDDCB73A251CB22FE4F8658A0AA7989A78552B36A7FED5BFCC1A2C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........4XA......=.........................................Q..........Rich...........PE..L....(.[.........."!.........................0...............................p......m.....@A.........................)..J....@..x....P...............0...?...`..p...p...8...............................@............@...............................text...*........................... ..`.data...H....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc..p....`.......,..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\msvcp90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6DE5C66E434A9C1729575763D891C6C2
                                                                                                                                                                                                                                  SHA1:A230E64E0A5830544A25890F70CE9C9296245945
                                                                                                                                                                                                                                  SHA-256:4F7ED27B532888CE72B96E52952073EAB2354160D1156924489054B7FA9B0B1A
                                                                                                                                                                                                                                  SHA-512:27EC83EE49B752A31A9469E17104ED039D74919A103B625A9250AC2D4D8B8601034D8B3E2FA87AADBAFBDB89B01C1152943E8F9A470293CC7D62C2EEFA389D2C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..qQ.qQ.qQ..*.qQ.#..qQ.qP..qQ..>..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.Rich.qQ.................PE..L....=1G...........!.....$...p......B........@....Hx................................`.....@.........................@C......d8..<....p...................$......D2...................................$..@............................................text...!#.......$.................. ..`.data...h&...@.......(..............@....rsrc........p.......B..............@..@.reloc...B.......D...F..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\msvcr120.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7F8DA89204332DF95CFC41F6E85DC515
                                                                                                                                                                                                                                  SHA1:7E8D71E1F2F9729A52B2938BFDDE69E56E6DE488
                                                                                                                                                                                                                                  SHA-256:1C8449F417566DD0FD69DC21EF77D46B9475FBAAC731DA35BDC71669F22242C8
                                                                                                                                                                                                                                  SHA-512:D48B833CBC9DB97D7BE4E986BE25AE097D1F55A33D591C5F554EC95D0D329F7CDC50687E16429289308A212CB00A8E2A640039CA7A056C5E03F58E21D3B27B33
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0iP.^:P.^:P.^:..:S.^:P._:..^:]L.:..^:]L.:1.^:]L.:f.^:]L.:..^:]L.:Q.^:]L.:Q.^:]L.:Q.^:RichP.^:........PE..L......V.........."!......................................................................@.........................`........R..(....p..................@?......\]......8...........................0...@............P...............................text............................... ..`.data...De.......V..................@....idata.......P......................@....rsrc........p.......2..............@..@.reloc..\].......^...6..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\msvcr90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E7D91D008FE76423962B91C43C88E4EB
                                                                                                                                                                                                                                  SHA1:29268EF0CD220AD3C5E9812BEFD3F5759B27A266
                                                                                                                                                                                                                                  SHA-256:ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
                                                                                                                                                                                                                                  SHA-512:C3D5DA1631860C92DECF4393D57D8BFF0C7A80758C9B9678D291B449BE536465BDA7A4C917E77B58A82D1D7BFC1F4B3BEE9216D531086659C40C41FEBCDCAE92
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...a...a...a..,....a...a...a...3)..`...3?.^a...3...a...38..a...3>..a...3;..a..Rich.a..................PE..L....=1G...........!.....Z..........@-.......p....Rx.........................0............@.........................`....|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\msvcrt.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:14C8B0D022CDD56939E5385CBCAB60A6
                                                                                                                                                                                                                                  SHA1:B47A20174D1DAB0E2901C42BFBED251BE633280C
                                                                                                                                                                                                                                  SHA-256:A80846377F8E6BAAD467F4B0064CF929CF51629BAAF47044B7CB3F3C4E627476
                                                                                                                                                                                                                                  SHA-512:D43A4333AD0C7E1A99CBB6C069843865B354CD9BF2D5460CE0400E1AF38D7A24BE12E33215DBFCAABC16C082758EA3772CDA28086FE0405FA08DDF7BB91B21F7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...h.i.h.i.h.i.a...D.i.3.h.m.i.h.h..i.3.j...i.3.i.i.i.3.l..i.3.m...i.3..i.i.3.k.i.i.Richh.i.........PE..L.....X...........!.................[....... ......................................hx....@A.............................x...............................=......d7..P...T............................................................................text...n........................... ..`.data....]... ...<..................@....idata..8............J..............@..@.rsrc................`..............@..@.reloc..d7.......8...d..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\ntldr (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS executable (COM)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:418B54CAD38B9EA48A8DA2774E15959F
                                                                                                                                                                                                                                  SHA1:E73CBCF2B27E0A62221E36EFDA7A8E3A8925EE13
                                                                                                                                                                                                                                  SHA-256:7F27C6A7BC77387055D46EAF7A7ED53FC18FC64F6576C1FB4D3338DAF622F120
                                                                                                                                                                                                                                  SHA-512:E572589B81A8E53ECBC24E8F6A64AD72402978FB77ABD86BAD004C016A64DF5401DBE3486BE102CFECAFF77758F306F3AC3B0B5B5B7035178CBE0DB4B7F921FC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.........R....f3....4..Q......Pf..T.f...f..f............X.0..........Z.....RQ.fS.D...f[..........YZB..J...fSfSP....:.f..Xf....f[.......3......P..f;........f...f..f..X.(..f[.fPfRfQfS.f..L.f..f.M....]..f[fYfZfX.PfQ3..$.A.......@;.....fXfPf;..........fYX.P&g....>.......$........fCfC.................f.............X.fQf.....>.......f..f..f....f..f...f3.f..fY.fPfSfQf..L.......f.L.f..\.f..D.f..f+.f..D.f...f...f..fHf3.f..f+.f..D.f+.f..f..L.f3.f..2.f=..........fYf[fX.B..0/........(.R...f...f...f.....f....3.f...f.........fh....f...W.3....j0..............l..D.h..h..D.h.. .......f......"......f...."......jXhm..`....3...........(.........WV...~.&..-..s.&.....R..=...r.&.E....B..... ..WP&.E.&.].&.M.&.U.&.u.&.E.._..&.E.&.E.&.].&.M.&.U.&.u.&.E...^_................................................................f.v.f.~.f.N.f...........gf.f.N.f....g..........f.~.f.N.f........f3...gf.f.N.f....g......................6...`........ .f%....."....... ....."..... X...l..D....h..D......

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\opengl-blacklist.json (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A0F4426B03D0D8511DF37FC5134A6163
                                                                                                                                                                                                                                  SHA1:834DEE2A6A914EE884B452454C0C4CE91189B7D0
                                                                                                                                                                                                                                  SHA-256:6F7424B184DA92124D17E1C39ECA6EDEADA7D0CF517BB386336087A1CE014963
                                                                                                                                                                                                                                  SHA-512:51798FE841A21D09EBF7AD873E1BE33F5868DB60987C69D67ABA65FA9904F1AF4953F8643E404D0A6CD6BD9CFC40629F0E2A7B84D63D6AB7CFD8710D3A388B4A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:{.. "name": "Qt built-in GPU driver blacklist",.. "version": "5.15.2",.. "entries": [.. {.. "id": 1,.. "description": "Desktop OpenGL is unreliable on some Intel HD laptops (QTBUG-43263)",.. "vendor_id": "0x8086",.. "device_id": [ "0x0A16" ],.. "os": {.. "type": "win".. },.. "driver_version": {.. "op": "<=",.. "value": "10.18.10.3277".. },.. "features": [.. "disable_desktopgl".. ].. },.. {.. "id": 2,.. "description": "Intel Q965/Q963 - GMA 3000 has insufficient support of opengl and directx",.. "vendor_id": "0x8086",.. "device_id": [ "0x2992" ],.. "os": {.. "type": "win".. },.. "features": [.. "disable_desktopgl",.. "disable_angle".. ].. },.. {..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\API-MS-Win-core-file-l2-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F12C1674574B16DDC17F4CCF68955E59
                                                                                                                                                                                                                                  SHA1:0C7D9B8B504A3DDC53C0B8E4066C8D829E65AE55
                                                                                                                                                                                                                                  SHA-256:A88202B5B8E62EDEAFB536AF25580B2B1A437860D86CD5D8A6FBA3C89B46ACD6
                                                                                                                                                                                                                                  SHA-512:084776CB0C9E7E3708CD67BD2E075BD6878A13EC0DD70F46ABB7532E7153DDC4C5AFBCBBD477A62432BEF0E1381E06A16F951F7C701B1C6EADEC93514834BB39
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......R.....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ActivationOnline.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:45E1EE96B93ADC5E4C804F5853BFF163
                                                                                                                                                                                                                                  SHA1:9BE871B9E68521CAFBABA0C1CA7E45D42E30BC8C
                                                                                                                                                                                                                                  SHA-256:C1F17370F2CA73F6A27A0AFCBEB516C6DE87843F4845B78692DCF426C4658B59
                                                                                                                                                                                                                                  SHA-512:6DE577EC5B9D0902AD6C41FD4C836247A4346D0EB3B94E408F6F8D193639F7DBF5B8D482C1B8617E7485BFBF1411C847B9A7F432592FAAA45C0C56ACB12C345A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:..:..:...u].:..B^.:..BH.:..BO.:..BX.:..:...:..BA.:..BY.:..BZ.:..Rich.:..........................PE..d...`..e.........." .........~............................................................@..........................................^...... K...............p.......l...*..........p...................................................0............................text............................... ..`.rdata..2_.......`..................@..@.data...H....`.......N..............@....pdata.......p.......T..............@..@.rsrc................d..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\AppSetup.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5FD5DD3314050EC71B57E4D9F5BA5A8D
                                                                                                                                                                                                                                  SHA1:69651A725B7E596BB7434A642EEADA7D363E9AE4
                                                                                                                                                                                                                                  SHA-256:C4C95A65D7837014A6D1F486654972C00D6FB0BEFB6487B07FACE3E88EB26AD5
                                                                                                                                                                                                                                  SHA-512:430C611C706FFD9DB5F2413BD00FDB7E133C77A2ECE88FD7F20F22CCE41DDA7B7C605770CC6B6F9AA4447259A321D5BC1C112890C7F4F25F87B2D485BF9C5D66
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.6.?.e.?.e.?.eGpWe.?.e.GTe.?.e.GBe.?.e.GEe.?.e.GRe.?.e.?.en?.e.GKe.?.e.GSe.?.e.GPe.?.eRich.?.e................PE..d...J..e.........."..........f......xy.........@.............................0......c.....@.............................................h...4...x...............@........*... ......@................................................................................text............................... ..`.rdata...N.......P..................@..@.data...............................@....pdata..@...........................@..@.rsrc...............................@..@.reloc..6.... ......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\AutoLoaderAppX64.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CF771771DB7108010DFE075D429BCB99
                                                                                                                                                                                                                                  SHA1:7E59AD168B6D34BEF19E79652EE0586ADF126474
                                                                                                                                                                                                                                  SHA-256:0F20CAFFDAEC6C6C2E0C0D971E48E0128FF1CAF103DCC5E36F4A939381E37ED7
                                                                                                                                                                                                                                  SHA-512:75F9ED60851B7831F1623EAD0EC45D9C3FBF2233078768AF701272D66D3AF6969DF895C732556D6330FC067A5337DFAD3DE000294E9D0F66073C7FBC1A2EC12D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................y.....o.....h................f.....}....Rich...................PE..d......e..........".................(..........@.....................................u....@..................................................7..d....p.......`.......4...*...... ....2...............................................0..`............................text............................... ..`.rdata..&....0......................@..@.data........P.......*..............@....pdata.......`.......,..............@..@.rsrc........p......................@..@.reloc..J............2..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\AutoLoaderX64.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6C8AE9DCA4EBB34159805BDA29FDDC32
                                                                                                                                                                                                                                  SHA1:2C77FAAC60028D19FCF2D6CB9C77309D83E7F0EA
                                                                                                                                                                                                                                  SHA-256:843B4A1FCC5E3BB7841A581CAE391D18CB9EE320F6B2F1A7E0D37CD1B4AAF851
                                                                                                                                                                                                                                  SHA-512:79502E60C470D252FBE7154760AB32CD09F97C5769C8EF9DAADE0ED4EC79A6C9F7C41419AC421DD29B33FA886B1D6FFF565DB2F315DCDB176337FACA1A00C237
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................../.%.......&.......0....... .......7....... .............9.......!.......".....Rich............................PE..d......e.........." .....|...V.......w....................................................@.........................................@...........x........................*..............................................................P............................text....{.......|.................. ..`.rdata..!=.......>..................@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\BCImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1490CB852CD79C9962135E90D499D3A1
                                                                                                                                                                                                                                  SHA1:47F5295AA4D5E0D78DA4A194EED9130DF91D1B09
                                                                                                                                                                                                                                  SHA-256:E5FE6C5337207A63C6F629CEC21D186C489D16DF7206070099B00F3A05EBC659
                                                                                                                                                                                                                                  SHA-512:60501B8A2511B32615081BA23F92CF9A8299AE1D461374024242CCA1B35B7DEB5BF7BEDAADCED835173461FE6FC351D585BE3A05D266C88B6642662EA8959BA5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......OS.#.2.p.2.p.2.p.}Zp.2.p.JYp.2.p.JOp.2.p.JHp.2.p.J_p.2.p.2.pq2.p.JFp.2.p.J^p.2.p.J]p.2.pRich.2.p........PE..d......e.........." ......................................................... ............@......................................... .......\{..................|5.......*..........P................................................................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..|5.......6..................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\BackupCloud.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2FE1EC30432F2B5F71BB9BBFA8C513BF
                                                                                                                                                                                                                                  SHA1:8FAD0814E15638DE968ADF2451D918202043AF5A
                                                                                                                                                                                                                                  SHA-256:4F397F47C456482A3CE871C0BD3F7929BF69554CBE09DE6AB6483F64A8F864E8
                                                                                                                                                                                                                                  SHA-512:7FA8A39170464AAF92A0913BB67BC9754E81977F594FDBAFD89D62677D8C817E749DB9BD789331A4A638451E24F874E6B4E9E93CEAD0D7F788402E670E46089A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r}.M...M...M....\..L...Dk..O...Dk..F...Dk..D...Dk..@...M.......Dk..^...Dk..L...Dk..L...RichM...........................PE..d......e.........." ......................................................................@......................................... p.......Q...................4.......*......@....................................................................................text...6........................... ..`.rdata...p.......r..................@..@.data...0............`..............@....pdata...4.......6...j..............@..@.rsrc...............................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\CallS3.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AF2BDB2265245E99189C4ABA60AC71ED
                                                                                                                                                                                                                                  SHA1:3FD925C2D104D9C0B9A0E7656C8900065BC7DF16
                                                                                                                                                                                                                                  SHA-256:60F383C9A598F35CBCAD8A0C997B42CEDD53A79D7F1AD00C98C441C6CC4E3D64
                                                                                                                                                                                                                                  SHA-512:77AA728FC01BCEDAF642477912151DA27AC7D662CA547104C6BF9A6164B08E402387036F9BE3669F0AB11A3B14EF1D1DA6186D7BA1B2CA2E74A5B199510B5103
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........XE..6...6...6......6...2...6...5...6.e.7...6...3...6...7...6...7...6...7.).6.h.?...6.h.6...6.h.....6.h.4...6.Rich..6.................PE..d...v>.d.........." ................................................................l$....`.........................................@...X............`.......P.......,...*...p..l.......p...........................p................................................text............................... ..`.rdata.............................@..@.data........0......................@....pdata.......P......................@..@.rsrc........`.......&..............@..@.reloc..l....p.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\CallbackOperator.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6584C8E80981D3D810F434585BC8FAF4
                                                                                                                                                                                                                                  SHA1:13D3463E2739E8E8606CB40E39BC5FE5B4EB4567
                                                                                                                                                                                                                                  SHA-256:F494705E5AA05D2D7B039D940F5F774F5368F978B26E6D459F49CCBBC4AFF320
                                                                                                                                                                                                                                  SHA-512:515CB4BBA8C28903E4866CBFC2BD27A0CE8C9D261DC6D999CC13D50334013AE1AA17B4C4F2319FB70F1B8C8A7E0A454684F21D898DCEE0C010019AFBB6742FDD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K............0.......................................................................Rich....................PE..d...o..e.........." .........2....... ....................................................@..........................................C.......<..P............p..|....P...*......(....1...............................................0...............................text............................... ..`.rdata..X....0......................@..@.data...@....P.......6..............@....pdata..|....p.......F..............@..@.rsrc................J..............@..@.reloc..\............N..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ChromeData.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C18CEFA67EA7BE11D5BD37054DC9CFDD
                                                                                                                                                                                                                                  SHA1:06083CDF5A60BEFFD9C730FDDF160EC427F4792B
                                                                                                                                                                                                                                  SHA-256:E9A065A47B10F2D06B1F041FF5DFCD928A5F2F0478AA6099E2CDBABB8CE46511
                                                                                                                                                                                                                                  SHA-512:DBE9B85023E4BBC590F2ADE7A3E9C4723CE7BD36470F24EFB923374D4ADE1840FBD10C32C854B593122D5DF37E9BE73A26EDC5E5D6716CA7B78F6FFDB27EF790
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*6..KXZ.KXZ.KXZ.3.Z.KXZ.#\[.KXZ.#[[.KXZ.#][.KXZ.#Y[.KXZ./Y[.KXZ.KYZ.KXZ."Q[.KXZ."X[.KXZ.".Z.KXZ."Z[.KXZRich.KXZ................PE..d......e.........." ..... ...................................................0......^1....`.....................................................,........................*... .......j..p................... l..(... k...............0...............................text............ .................. ..`.rdata..6....0.......$..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ChromeDataBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A56061A426047A0A716DFCAE89A1FD3C
                                                                                                                                                                                                                                  SHA1:25C8D99635F5108DBD514BE6C023A3E78F51DF4C
                                                                                                                                                                                                                                  SHA-256:8D50064838EB70863EB5A7CD6378140EB372E1A86659CF4DA26C6DECB45D4ACA
                                                                                                                                                                                                                                  SHA-512:13BE1D82B3C14994A7E40B4EECD6FCB766E9788B43B094CFAD5B4F91E99EDCA8F377081BB3F7878AFE25A47B8636B77094CA5A5887DC6D1E58722031DA144AA1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i....j.h...`.i.d...`.......`.x."...`.o.b...i.......`.v.a...`.n.h...`.m.h...Richi...................PE..d...r..e.........." .........B.......[..............................................t.....@.........................................p...........x............ ..._...<...*......t....................................................................................text...z........................... ..`.rdata..............................@..@.data...d\.......(..................@....pdata..._... ...`..................@..@.rsrc................,..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\CloudInterface.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6E3F47C4E51ADB4DD6A2F44793F61C18
                                                                                                                                                                                                                                  SHA1:92B77D142CB0693C0E5BBCA3CF58E732FEADCC87
                                                                                                                                                                                                                                  SHA-256:7339F719D514E6F9580891C26D370830ACBE2EB3AF6FEE8E8F40A34E53EE0CBB
                                                                                                                                                                                                                                  SHA-512:9FE0F9FD6ABF1DD93F022449501208CA4A94D856F40CE2D6E807F1EBFB7572A4C3B432D8E2B32CD982C5E7F9EB9454FCA78B3D7B07E3FF772A83D050DCA23445
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............r...r...r.7...r.....r.....r.......r.....r...s.;.r.......r.....r.....r.Rich..r.................PE..d...c..e.........." .....v...8.......K....................................................@..................................................c..x................,.......*...........................................................................................text....u.......v.................. ..`.rdata..s............z..............@..@.data................t..............@....pdata...,...........z..............@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\CodeLog.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6AD3BCA9AE208462E741F2216D1B3324
                                                                                                                                                                                                                                  SHA1:222DF609B3E741563900C228C6DBC914C820C357
                                                                                                                                                                                                                                  SHA-256:CD7F006C9CBEAB45425626B9C0C3929829466B0B13BEA3C0DBB3546B93BCE7A3
                                                                                                                                                                                                                                  SHA-512:55D670BE80DE3B1092003A1AC0E99C5F9C0B6027A25CC52CCF18F8D9F324F06C38EA2BC22B2B867F9585691E547662BBD6F09C60EFC8E38C7659E409014EE308
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........j.9.9.9N.$9.9..'9.9..19...9..69...9..!9...9.9V..9..89...9.. 9.9..#9.9Rich.9................PE..d...@xUe.........." .........r......\~.......................................P............@.........................................P...........x....0....... ..$........!...@..........................................................x............................text............................... ..`.rdata...Y.......Z..................@..@.data...8...........................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\CompressFile.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3BE7237B0BE706535B1D36155590B5C9
                                                                                                                                                                                                                                  SHA1:C837228D811B2EA1302EBAA9B5A80DF5E8247518
                                                                                                                                                                                                                                  SHA-256:A9D117BC4A8428610905ED102AC3E63C19B3B569E98DE24884E6197922D46E8E
                                                                                                                                                                                                                                  SHA-512:B8C83CA17021778BF1D507FB9D5379537AACFD76A8A3D3DDDA75FCCAA8EA7D7F6B95BBDC04C16BE5BCF8614808351ED9DB72618E9A001C5682FAEC7DE2DF37EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.:..:..:...u..:..B..:..B..:..B..:..B..:..:..:..B..:..B..:..B..:..Rich.:..................PE..d...a..e.........." .................$....................................................@..........................................;...... 6..<....`.......P.......:...*...p..(....1...............................................0..h............................text...!........................... ..`.rdata.......0......."..............@..@.data........@......................@....pdata.......P.......0..............@..@.rsrc........`.......4..............@..@.reloc..F....p.......8..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\DrvSetup.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6F89D00A2F6FD1CB33D5DA6FD97A050E
                                                                                                                                                                                                                                  SHA1:2E26A9E48F3A7E14DCE16E115FF7FFB6DA0EFECE
                                                                                                                                                                                                                                  SHA-256:C4A7C9D1EB6C5E9080AAA9A7E8C1A9CC6463BBABF3B40906F11B749923A594A2
                                                                                                                                                                                                                                  SHA-512:4BCA08354417D875EDCBE0206F371593CA5452288F0FDD3ADA2A960F39932145C644FF85B9F033D9B80A3EB722F55FAE69ADBE4EE90E8476AF15378A32E353F8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TE...E...E.....}.G...L.~.G...L.h.V...L.x.V...E.......L.o.T...[...D...L.z.D...RichE...........................PE..d......e.........."......$..........|'.........@....................................dC....@.......................................................... ..8................*......4....................................................@...............................text...A".......$.................. ..`.rdata..l....@.......(..............@..@.data...............................@....pdata..............................@..@.rsrc...8.... ......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\DsImgFile.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6AF20E9147018998A9477CC7DD7CBAAD
                                                                                                                                                                                                                                  SHA1:77BE155985EA2F1AA2E428B8B40CE91E2F3D5A1E
                                                                                                                                                                                                                                  SHA-256:42C87029F0E917D4917BF2C2AA89BB45EB57FB5240B2A8107EA8C24B709CE973
                                                                                                                                                                                                                                  SHA-512:8D3D12AF357599934D9BDCC558E8F3910530E0901FA1C04C4CD3BAEBD9ED64DE8AB831A2DB25F99E2FB9429E86F5057AE5A5A7D2D826D2D538F10152C89CA5DE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.F.7.(.7.(.7.(....5.(.>.5.(.>.&.(.7.)...(.>.".(.>.<.(.>.~.(.>.6.(.>.6.(.Rich7.(.................PE..d...7..e.........." ................<........................................p......f.....@.........................................._.......H.......@...........w...$...*...P..@....D...............................................@..x............................text....,.......................... ..`.rdata..Q8...@...:...2..............@..@.data....0.......*...l..............@....pdata...w.......x..................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\EULicenseDLL.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8E966E640F56AE55AE15A54EA047C99B
                                                                                                                                                                                                                                  SHA1:CF012A1A0F5D2C60ADFC04DCD19E27695413E63E
                                                                                                                                                                                                                                  SHA-256:C7D82D6557DB7AE59636630A580667C15BF17C8DFDBB1A6016091178D8AD07B4
                                                                                                                                                                                                                                  SHA-512:595BF1D96B6486A7C00C44D5E1EDBCB84DE44FB3466C1E588240883B40122667164EFE6627AE3A633C0F26BDF3F4E3C6C9AD3D7DB19B0D46B0753D3947D2B9D2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1\.qu=a"u=a"u=a"|E."P=a"|E." =a"|E."|=a"|E."r=a"u=`".=a"|E."p=a"|E."t=a"|E."t=a"Richu=a"........PE..d...e..e.........." .........b.......0..............................................D.....@..........................................%..|...,...P....p.......`.......<...*...........................................................................................text............................... ..`.rdata..\8.......:..................@..@.data...P&...0......................@....pdata.......`.......*..............@..@.rsrc........p.......6..............@..@.reloc...............8..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Email.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:84686C294FD1F911193A28484A504F47
                                                                                                                                                                                                                                  SHA1:A2D303A2CB902AC7517FAF1B756B2682DD6C118C
                                                                                                                                                                                                                                  SHA-256:C529A2ACF61D5A9D4E5F6D34C5DA40B89855E139AEF94B14D3C48784FA99FCAF
                                                                                                                                                                                                                                  SHA-512:9924C00722200C77F2857D712D47D53D6093EAB7E1403D4D3FFDCDF98D5C24FE185DE2842436AB45BADEE713E4FFE3D9E149BA89E5EBDDCAECC86DB35482FCCD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..o..o..oh.Ho..o..Ko..o..]o..o..Zo..o..Mo..o..o...o..To..o..Lo..o..Jo..o..Oo..oRich..o........PE..d......e.........." .................................................................r....@..........................................L......<)...............`.......l...*..........p...................................................8............................text............................... ..`.rdata..............................@..@.data...0....P.......<..............@....pdata.......`.......B..............@..@.rsrc................`..............@..@.reloc..x............h..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\EmailBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4F31B22D8DFB414FFEC178239013FC4C
                                                                                                                                                                                                                                  SHA1:8204125A650D145C2298EFD88003C4E2224F92C3
                                                                                                                                                                                                                                  SHA-256:5614D9A35E7F2D17D9F533C6C4BA2E0E63F0A37A22B13B76C2723D056F6D4E31
                                                                                                                                                                                                                                  SHA-512:EB93D63494E547C6C8BAF0BC69AD0AB314E910505DD0941792AC5C7FE79319CE7502C59F8CBED07ECC03BAF4EAB48B7283C94124F5EE425062157E9E6F3C8A44
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i...&o..i....l..i....z.fi....}..i....j..i...i...i....s..i....k..i....h..i..Rich.i..........PE..d...s..e.........." .....\...................................................`............@.............................................j.......<....@..........`E.......*...P.......t...............................................p...............................text...J[.......\.................. ..`.rdata..j....p.......`..............@..@.data....Y.......&...~..............@....pdata..`E.......F..................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\EmailBrowser.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DCB947F7E3CB5391B399AA0FB8793ABE
                                                                                                                                                                                                                                  SHA1:CF6A0A4E4F358F3D1D6AA74E6DD09AF96D77534E
                                                                                                                                                                                                                                  SHA-256:7E35624AF9C52CEE5FDBE200B82EDDE5DECBE27EA70B41D135B366BFEAE0BD62
                                                                                                                                                                                                                                  SHA-512:E99FEFF77D75405CA611A57031858CA55B789E3CB20B6191C8B67477E3868DA0CA7B9C25615DE855F01733DEFC7D15EED8B93B97EBAB276019266428F2C03990
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]T0..5^U.5^U.5^U.z.U.5^U.M.U.5^U.M.U.5^U.M.U.5^U.M.U.5^U.5_UL5^U.M.U.5^U.M.U.5^U.M.U.5^URich.5^U........................PE..d...t..e.........." ................(.....................................................@..........................................q..k....e..x....................v...*...........................................................................................text...e........................... ..`.rdata..[b.......d..................@..@.data...(............Z..............@....pdata...............^..............@..@.rsrc................p..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\EmailRestore.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0CE8021018F4487E2C4627EA9D50A1C5
                                                                                                                                                                                                                                  SHA1:123374E4BAE86561CC44EC2303C6B9E557307973
                                                                                                                                                                                                                                  SHA-256:19EA2D1AD8A46FD05E9F68DF7E1A9439E71BA983D91415D5E8427CF3B7FE7D0B
                                                                                                                                                                                                                                  SHA-512:99DE7C5237FDC3974187D7CFC8EEAC65816A948270D62FC7DED624C7AF72F71A87E760A94D9EF59D86328BE7E0970D7D54D178E4FDA5E32893A19B8EA4DB7AF9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>./z..|z..|z..|..{|{..|s.x|w..|s.n|..|s.i|3..|s.~|...|z..|...|s.g||..|s..|{..|s.||{..|Richz..|................PE..d...s..e.........." .........p......lO...............................................A....@.............................................k.......(............@..t=...B...*...........................................................................................text............................... ..`.rdata..{...........................@..@.data....Y.......&..................@....pdata..t=...@...>..................@..@.rsrc................4..............@..@.reloc...............6..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\EuActiveOnline.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DE588A4311344706C8068AB5B82D1ED0
                                                                                                                                                                                                                                  SHA1:4DA7331F6DC3B7F8818360574774A0ED2F91AE74
                                                                                                                                                                                                                                  SHA-256:891C58ADB569D432B50AFE6895600E5B3F0A9D967E1120617990A8B3D958964A
                                                                                                                                                                                                                                  SHA-512:6AEAB24FD5F6CE67290F9C5DB8B60530687974BF8E3F968F2A357C4C317923C468124068C371FB4558C4BA0ECAE66A345E629E27C90B7F5E2F28104E04DAD4BC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u)...z...z...z...z...z...z...z...z...z...z...z...z...z.M`z...z...z...z...z...z...z...z...z...z...z...zRich...z................PE..d......e.........." ................`................................................0....@..................................................................`...Q...x...*..............................................................8............................text............................... ..`.rdata..............................@..@.data....b.......<..................@....pdata...Q...`...R..................@..@.rsrc................j..............@..@.reloc..>............l..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\EuPipe.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9DD8569FE61CDD62B5D73C5DB2B4B1CC
                                                                                                                                                                                                                                  SHA1:D93EC3D7F8D0D18AB86D883AEC914775447EBC7D
                                                                                                                                                                                                                                  SHA-256:613CB803EFD37AFA644509DF6740222306366ACC55FA434B769A11295EFEAFA5
                                                                                                                                                                                                                                  SHA-512:AE34DD69679291636CF3F13BFF4F6FB24780378CE5174D92B61C937AC1051695AE8D169ED22120C8C1E9D2FF0BB4746F586245A69B834A4D7DF52F079FAD52B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\/.+.Nhx.Nhx.Nhx...x.Nhx.6.x.Nhx.6.x.Nhx.6.x.Nhx.NixfNhx.6.x.Nhx.6.x.Nhx.6.x.Nhx...x.Nhx.6.x.NhxRich.Nhx................PE..d......e.........." .....l...P.......f...............................................x....@......................................... ...........d........................*..............................................................x............................text...~j.......l.................. ..`.rdata...4.......6...p..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..8...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ExImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DE879E228576075315B75AD877C0F592
                                                                                                                                                                                                                                  SHA1:314BA7172433437F223A7940B8DB2B276C3DB4C9
                                                                                                                                                                                                                                  SHA-256:E839A1C297BA6F7A0653F54357B01AE4F6F7F8C5D329C6F477AA936BBA586A50
                                                                                                                                                                                                                                  SHA-512:CD4E6CB50283B2A49351FA61A7395DD075063D671E1E9DC0A0322D298226F67C3523426603046D75DF9CC9CF2334CCD88C4DDFB7452B875963C9DECF43ACA35C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.s/...|...|...|..|...|..|...|..|...|..|...|..|...|...|...|..|/..|..|...|..|...|..|...|Rich...|........................PE..d...O..e.........." ................t...............................................U.....@.............................................f...............D....@...8...h...*...........................................................................................text...[........................... ..`.rdata...d.......f..................@..@.data...P$..........................@....pdata...8...@...:..................@..@.rsrc...D............L..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\FatLib.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D2267DA601E4759B18BFA5AECCE7A0F6
                                                                                                                                                                                                                                  SHA1:97E7C0B11582DBA79CBA82939172D02AE16D9ED6
                                                                                                                                                                                                                                  SHA-256:327D4F3FA7B633B24D0B4B96B1F12259C4BD332A27980F6C3362CD6CB8AE39D9
                                                                                                                                                                                                                                  SHA-512:FBC121C67BD2D3B93A8727337FB448F11D94958C36C3A238760ACD9B6196DA38F63F918FDF68B0279BEF167EFF94475B6B38C57A6C1B1FE128AF2D6D2B701911
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ro..ro..ro.S=...ro......ro......ro......ro......ro..rn.ro......ro......ro......ro.Rich.ro.................PE..d...m..e.........." .................................................................t....@.........................................P...}.......P....................`...*......P...@................................................................................text...<........................... ..`.rdata...F.......H..................@..@.data....T... ...L..................@....pdata...............J..............@..@.rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\FileStorage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DB74FD58194A8435ECA85817178727FD
                                                                                                                                                                                                                                  SHA1:58D829DA78ABC6DB82B6916968B90C5878915D80
                                                                                                                                                                                                                                  SHA-256:FE87D34178AC4C6A726CDE5D9361859BE668A884A0E5647BECF8918EAEBAD8F4
                                                                                                                                                                                                                                  SHA-512:A4848156C86DE192883A53C644A4F3D91F103C6212641635F5D80DAEAB33FFA38E4FBCE5F493C579E856133B1FA4EAA6388304AB71E763AC42937FA37ED896A6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.............'...........................................^...........................Rich....................PE..d......e.........." ................................................................*.....@.........................................0>..........................4....T...*......h.......................................................P............................text............................... ..`.rdata.............................@..@.data...(>...@.......&..............@....pdata..4...........................@..@.rsrc................L..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\FlImgFile.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DC610E241FCF57FBFD440AE6832EA49C
                                                                                                                                                                                                                                  SHA1:413F72AF1CF65C2E38449884961C822D689D9C73
                                                                                                                                                                                                                                  SHA-256:93E2C110214D2FA9983DE735857FEBF7EE49DBD5507076150365D9EB0703EC22
                                                                                                                                                                                                                                  SHA-512:CDB242F49EA358DC18EA9844AC38C488324994EB7F7BD5E37FAF2BEAF2CD2116B3F54369BB77A0BDFD42471E37DF1EA831118BA24C618FAC4895C5A7337CB2B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^ZB..;,..;,..;,.t...;,..C...;,..C...;,..C...;,..C...;,..;-.;,..C..";,..C...;,..i...;,..C...;,.Rich.;,.................PE..d...M..e.........." .........................................................p......%.....@..........................................J.......0..x....@..........d.... ...*...P..\....5...............................................0..0............................text...v........................... ..`.rdata...1...0...2..."..............@..@.data....5...p... ...T..............@....pdata..d............t..............@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\FlImgFile.dll.intermediate.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4B8516B28CA0E2574152EE969F7FA1B1
                                                                                                                                                                                                                                  SHA1:FF8EA55DFAEBB5D0E1A119EC81AEB46E59376AB5
                                                                                                                                                                                                                                  SHA-256:BF2B8BC4398B677FF5FC9B208A97CEA90A14D90A6417A48397642BEF2F06A111
                                                                                                                                                                                                                                  SHA-512:92F7CBFEEAB7147D7725C1B19966D690EAB2942F11B6F97B8ABE87255758D1A4DC0CE95D93E9BC3D27CA6ABF3307B7B4224FB184C7DB7D35EB2C8C9FF8DB4919
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version='1.0' encoding='UTF-8' standalone='yes'?>..<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level='asInvoker' uiAccess='false' />.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.VC90.CRT' version='9.0.21022.8' processorArchitecture='amd64' publicKeyToken='1fc8b3b9a1e18e3b' />.. </dependentAssembly>.. </dependency>..</assembly>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\FsDsReader.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:427D87E84D6EE09A576C42EC9827C717
                                                                                                                                                                                                                                  SHA1:918BCAC19E064DA83A8D8C475A0CC66A9AD3F6F1
                                                                                                                                                                                                                                  SHA-256:E95964D1BC928F8C4F389F7B15615F0802885C0D169BCBD0EFA4953B11D215BC
                                                                                                                                                                                                                                  SHA-512:21381C38A6EB80F5D733290D986972707E33DA75D0369C93A4B5C7D25D4E7F09C6D3279A60D2DA4F8952A8DBF61EE823BDFF01C5114F5D8C9053D4ADA0BDCB48
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<haTx...x...x....F..y...qq..z...qq..s...qq..p...qq......x.......qq..u...qq..y...qq..y...Richx...........................PE..d...:..e.........." .........j......H....................................................@..........................................9.......(..P....`.......P.......H...*...p..<....................................................................................text............................... ..`.rdata..,J.......L..................@..@.data...x....@.......*..............@....pdata.......P.......0..............@..@.rsrc........`.......@..............@..@.reloc.......p.......D..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\FsEmReader.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:67545DCF08D3C5B034DB48E28F14D289
                                                                                                                                                                                                                                  SHA1:2912E038DA79D4FAA09CE6D54E780D86ACEA2140
                                                                                                                                                                                                                                  SHA-256:320EA26F37B68AB95E7E43932A3E29222D915BD1A26CE045700D6878DA8F3949
                                                                                                                                                                                                                                  SHA-512:CFF9E03D80670EE6DB9F89082BE38A931E87931FFBAB2CB22058CCD2FA30D1BA23EE20BD8977847496003E209A4738A68898BD2D570D43A7E6114D1EB6867177
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Zq..............._......h......h.......h.......h.......~......h.......h......h.....Rich....................PE..d...5..e.........." ......................................................... ............@.........................................p........g..x................C.......*.......... ................................................................................text............................... ..`.rdata...t.......v..................@..@.data...p............z..............@....pdata...C.......D..................@..@.rsrc...............................@..@.reloc..|...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\FsParse.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4E6881347C3867CE6FA05FF302BBB798
                                                                                                                                                                                                                                  SHA1:E8DB268770CCB5E4F0353F2F812088E6DAFC9C81
                                                                                                                                                                                                                                  SHA-256:75B02FACFDC5F24A9C58B8B2CA89B5B252DA188F3E4CA8D0961D64805CFDCF7C
                                                                                                                                                                                                                                  SHA-512:71386FE3904B24EAA43B33423D27D6D958157B9F604B10016E70710B6895FA56F5F814415B8029FBCCCA2AAFBB6C6ED5A63E6B7216B70727F0AA21C3F28B47E8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i.46-.Ze-.Ze-.Ze...e,.Ze$..e/.Ze$..e&.Ze$..e$.Ze$..e$.Ze-.[e~.Ze$..e%.Ze$..e,.Ze3..e,.Ze$..e,.ZeRich-.Ze........PE..d...9..e.........." .................o....................................................@..........................................!..f.......d....`.......@.......@...*...p......................................................................................text.............................. ..`.rdata..............................@..@.data........0......................@....pdata.......@......................@..@.rsrc........`.......4..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Ftp.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9598A39BF9C11ECE1844C558E9B9ACAB
                                                                                                                                                                                                                                  SHA1:9580CB6F1783BF8661027FA1027D8FB843AFF4CA
                                                                                                                                                                                                                                  SHA-256:475BE681202CCDF07674053584A093C67E0808DA8EDE42E746784524B10811B6
                                                                                                                                                                                                                                  SHA-512:A04B014460375DDEE64A105BA281BEA9ECD42E9BB325937D2EFDADF7EDB43504EA7895F3F5AF39143F99904CC6DD59BFBE2E22B538EE09C6B36DDABEDB0AFCDC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.A.../.../.../.....'./.....z./......./......./.....z./......./......./......./......./.Rich../.................PE..d...?..e.........." .....2...................................................@............@.........................................p...........P.... ...................*...0.......................................................P...............................text...*1.......2.................. ..`.rdata...f...P...h...6..............@..@.data....9..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\FuncRun.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:658B346BA09199944A42321E8C72A706
                                                                                                                                                                                                                                  SHA1:00E485115A91638E2E66DD948943DEE97CE1A9D7
                                                                                                                                                                                                                                  SHA-256:E357E0499B69C7982BB5976CBEA25C49A5A53C260F504ACE91291C5613AF8669
                                                                                                                                                                                                                                  SHA-512:ED4D4D27FC002CCA1165027034C35DAFB55081002D15741D846B16FE1DB963840A598F62D8C53920E3159A76A0A5B6EB141EBFC7EC4CCA0789E03CE30AAA2835
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.\M.\M.\.'\L.\D.$\L.\D.2\_.\D.5\E.\D."\D.\M.\(.\D.;\J.\D. \L.\RichM.\........PE..d......e.........."..........n......`..........@....................................-.....@..................................................P..d............p..H....n...*..........p................................................... ............................text............................... ..`.rdata...L.......N..................@..@.data........`.......N..............@....pdata..H....p.......T..............@..@.rsrc................h..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\GameDataBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:302D000CC37975044AF5BE4AB5EF1265
                                                                                                                                                                                                                                  SHA1:F85BDF9753CC26C623C001688D4BC8B9872F39D7
                                                                                                                                                                                                                                  SHA-256:620016C4FAF8E3922A6298B72FC967E5AD7E154856135C0FC60967A1DF7D4597
                                                                                                                                                                                                                                  SHA-512:478E97D87AD0D463B84970E112C268A8EB82F3A35C32E26585ADD4FCF03445E2A7DFD51FFD67E97E2B4C46D49E1C9799761686EFDC8365136C0F57959CF7C06E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PXx..9...9...9...v...9...A...9...A...9...A..Z9...A...9...9...9...A...9...A...9...A...9..Rich.9..................PE..d...f..e.........." .....x...F............................................... .......q....@..........................................)..........d................m.......*..........@................................................................................text....w.......x.................. ..`.rdata..6............|..............@..@.data...._...0...,..................@....pdata...m.......n...D..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ImageMerge.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:69C3826C74C5AB669970F38EF003E8AF
                                                                                                                                                                                                                                  SHA1:F9BF244D8D2D23A99E232C551F15BACAC0B41AB7
                                                                                                                                                                                                                                  SHA-256:A0322F3D1BE69B31DFF7A03A644338DA0439BD2DCFD1F2D29F8DD8357C12EC44
                                                                                                                                                                                                                                  SHA-512:C92456233648038B35B6A393F1981BAB9775406DFDA6B1111279CD983B6909E005B516EC38A3B2533640B18CC65E9A12078C0422D2539AA172E331EFDE1E6989
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........da...2...2...2...2...2...2...2...2...2...2...2...2...2...2@..2...21..2...2...2...2...2Rich...2........................PE..d...}..e.........." .....P...N......(v....................................... .......H....@..........................................^.......4...........................*..........ph...............................................`...............................text...5O.......P.................. ..`.rdata..j....`.......T..............@..@.data...@........:...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..2...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ImageName.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4578588E724DB7176D7B143A552EB479
                                                                                                                                                                                                                                  SHA1:CB2382333D031CEB722ED940C951DF2796249273
                                                                                                                                                                                                                                  SHA-256:4CD7AEF3711CEC3A9A88B84C99847CD5DE288A3BC9B7D758CADC4919042D4579
                                                                                                                                                                                                                                  SHA-512:DCF0E028D3E37F653A42F0A8E13CDD4BB5CE61753E9E1CCE2DE335544CF502D889A814B449AD70287F695CB9B3CE8DD749CF8D3892A8600834E59880D0BA48A4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?..A^..A^..A^......@^..H&..C^..H&..M^..H&..G^..H&..J^..A^..,^..H&..@^..H&..@^..H&..@^..RichA^..........PE..d......e.........." .........P......$........................................ ......I.....@.....................................................x...............D........*...........................................................................................text............................... ..`.rdata..{8.......:..................@..@.data...............................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ImgFile.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EDBEF6D7C7104F5980A47DF6C31C0EB9
                                                                                                                                                                                                                                  SHA1:EFCD69FB7B089FD13C604374093614E862A30F48
                                                                                                                                                                                                                                  SHA-256:20A0AF4D3DFEB773713EDF9F3D0537B2693DBAAB4F855DC9FABCB1BC88EFB222
                                                                                                                                                                                                                                  SHA-512:3170B33D2B377EBA3FF6925C553C8A8EE363244F783FCAA6F3EF885D3AFA754EA6EB93859F2847582C73D37EFD751AD9C230B66D20227556D1DE333FEA625DE8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(.,zl.B)l.B)l.B)..)m.B)e..)n.B)e..)a.B)l.C)..B)e..)x.B)e..)j.B)e..)d.B)e..)m.B)e..)m.B)Richl.B)........PE..d...$..e.........." .....B...........F.......................................`.......P....@.............................................a............@....... ...........*...P......0c...............................................`...............................text...Y@.......B.................. ..`.rdata..1....`.......F..............@..@.data...............................@....pdata....... ......................@..@.rsrc........@......................@..@.reloc..6....P......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ImgFileHlp.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7E84C73E74FB9BF6BD6950C1C92101EA
                                                                                                                                                                                                                                  SHA1:0855F17FB7CB60E07EBB92F83054D08F9B086A75
                                                                                                                                                                                                                                  SHA-256:2ED9DDB2BA74A9EE139CEA6EA5B05C74FB671235D3D9AAEE0AD1234774528C63
                                                                                                                                                                                                                                  SHA-512:F861841593383EB556AC90F16D1229C6FF2D3F0D361708DC8FE60BFD2AFFDCC49D97911B7C53AEEDE276DBFC6904BE46C1233F0C166C310797C7C307FF4BF145
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..J...J...J....UC.K...Cb@.H...CbV.A...CbQ.C...CbF.A...J.......Cb_.D...CbG.K...THA.K...CbD.K...RichJ...........PE..d...3..e.........." .....Z..........|J.......................................p.......h....@.........................................0...........x....P....... ..p#...2...*...`......Pt...............................................p...............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...............................@....pdata..p#... ...$..................@..@.rsrc........P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ImgFileHlpOther.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AE7382AAD57FBC3D845A28D2E7050479
                                                                                                                                                                                                                                  SHA1:9FA30D4DA7008A8125F7125B97F4FEA5CE373F38
                                                                                                                                                                                                                                  SHA-256:714F4732C6952B6FA689EBCF0E1446345563A52D7E06EBF9A056F3CD2EA13CAC
                                                                                                                                                                                                                                  SHA-512:DF62CD9FEC7EAEE0C51F4B4C07D6E40A01913D8B95D57664A1EBFAFBFBBB5D182D5C8EF445D7F8905A501BEBE91E5195A9857DE58337535DCBF9C229C6CF08EE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#.5.B.f.B.f.B.f.:Mf.B.f.:Jf.B.f.:\f.B.f.:Zf.B.f.B.f.B.f.:Cf.B.f.:[f.B.f..]f.B.f.:Xf.B.fRich.B.f........PE..d...4..e.........." .................).......................................`............@.........................................`................@..........t".......*...P.......4...............................................0...............................text...4........................... ..`.rdata.......0......................@..@.data..../..........................@....pdata..t".......$..................@..@.rsrc........@......................@..@.reloc..j....P......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Log.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:73F09203B5C1C6085AF7C8CFB2495B07
                                                                                                                                                                                                                                  SHA1:04ABF232C75FCA2792D282AF9464C1F041161E82
                                                                                                                                                                                                                                  SHA-256:C593C41FA576FC7059208351C818C2874BA9BCE30AA286A2B1C540C605365D08
                                                                                                                                                                                                                                  SHA-512:B019805285276B2B4A845C699A794EB06BA3C6F87EC9D1D65733EA816E69D1C30C5BE75BD92A9660C362BC2BDD863257B7419139591E7814007AE6974BD558CE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.7Pu.Y.u.Y.u.Y....t.Y.|...t.Y.|...~.Y.|...q.Y.|...r.Y.u.X.N.Y.|...q.Y.|...t.Y.|...t.Y.Richu.Y.................PE..d...i..e.........." ......... .......#..............................................l.....@..........................................B..v....;..P....p.......`.......>...*......4... 2...............................................0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.rsrc........p.......8..............@..@.reloc..`............<..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\LogSys.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:77F49FD768A1CE33F915322F7CD6C49D
                                                                                                                                                                                                                                  SHA1:74E93D168D3C1793A5CAB2205B0A0F9082C8C09F
                                                                                                                                                                                                                                  SHA-256:8DCA6EAF509A0EBFD63EC1868F409BEEED107A31CEA9681A826A26A62B82FE65
                                                                                                                                                                                                                                  SHA-512:D6C2EA04D707C621964331CE88D152EDB9EC6D544B390FD8543D9B88283B4A53F00409AE7E5191525D88DBB969A5FBACC31B53B9B0A91691F609BA97F3442346
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~..~..~......~.....~.....~.....~.....~....!.~.....~.....~.....~.Rich..~.................PE..d......e.........." ................P.....................................................@..............................................................................*..............................................................`............................text............................... ..`.rdata..............................@..@.data...@............~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\MatchStr.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:64768751F94D7D3A7D77D07CE9A50A94
                                                                                                                                                                                                                                  SHA1:162D1812EF1AC13DCAA01FF6FC83EC1AE7F7E92C
                                                                                                                                                                                                                                  SHA-256:F0211885DEFE18A010B274A3AFFAFF9013852D94D5BED7E5226633FB8289ADF3
                                                                                                                                                                                                                                  SHA-512:7D34BCE65EEF58C27D4FBE597A9E2B924FA457A661F56F8BA8D0FF8F20460155F749F0DE02E76CDD0FCB71FFE051F4AEAED3FC7A17F8108079303437A0BE6351
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%q.0a..ca..ca..c._$c`..chh'cc..chh1cj..chh!cl..ca..c...chh8cc..chh6cm..chh c`..c.B&c`..chh#c`..cRicha..c................PE..d......e.........." ................0...............................................74....@.........................................0...g...\p...........................*..............................................................@............................text...U........................... ..`.rdata..............................@..@.data...`............x..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\MessageFactory.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6EC9D1FB8D920837E9BE385E083E8B9F
                                                                                                                                                                                                                                  SHA1:FC80482EF110529481E437329BB6C3FAC271DBD5
                                                                                                                                                                                                                                  SHA-256:4EFC277B06A213F8BDBE0827F2E702D04562294DE4306A566CE9B893C3EABA97
                                                                                                                                                                                                                                  SHA-512:CBC91CA6CCF94F5190178AF0716B6CD3F3F9B5CDED2EABB8D5369BFD83A00BEEAF1BE65CB6857C572C3357961801EE69BE49C3535EDBB1AED53517799072581A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.2b!.\1!.\1!.\1...1".\1(..1#.\1(..1).\1(..1-.\1(..1*.\1!.]1.\1(..1:.\1(..1 .\1(..1 .\1Rich!.\1........................PE..d......e.........." .....$...:............................................................@.............................................w.......x............0...E...b...*...........F...............................................@...............................text...C#.......$.................. ..`.rdata..W....@.......(..............@..@.data...@...........................@....pdata...E...0...F..................@..@.rsrc................P..............@..@.reloc...............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Microsoft.VC90.ATL.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (502), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6BE3CB1A6E8FBEF7504E7925BCE90AE9
                                                                                                                                                                                                                                  SHA1:3420AA02C3FC68110455106E01845EB54FA39174
                                                                                                                                                                                                                                  SHA-256:08A557759E3D9CCCD4F6AF972A16474C05AF4E57A24C6CD773184CC0C9E0CDB0
                                                                                                                                                                                                                                  SHA-512:6639D9B902B33200795DFC84655724EE3FEF705AC5427A8EDD6CF6EBA07AAFC250A0C71ED863BFBF320E6FFE6AAFEB6EA37777E92789FD183F933C9E8C804638
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.ATL" version="9.0.21022.8" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="ATL90.dll" hashalg="SHA1" hash="a7f04daa50103e7ef31772e2978fe96ea1a97cda"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>9l843dT07F6g6i/gaWhAcsuGN6Y=</dsig:DigestValue></asmv2:hash></file>..</assembly>

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Microsoft.VC90.CRT.cat (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:378E43013CEAAC08368673B7D9FD97E6
                                                                                                                                                                                                                                  SHA1:853D0BBB2A874A9B97609DAB2C5276FA4FAC4A5C
                                                                                                                                                                                                                                  SHA-256:81C6FB67356AB72AB5375B7179A5B0C0467D524890194360783CC4971FEE6142
                                                                                                                                                                                                                                  SHA-512:186D425FA81F1A99B379EFFDFFB1E41FDDA7E40F26C5BF25BC43F266F6F6B33052EA31725AF25EE6E8D9005B677BE388038747955F755669C8378802A3683421
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:0.&...*.H........&.0.%....1.0...+......0..u..+.....7.....f0..b0...+.....7.....}NEp.~[A.tA......071107060506Z0...+.....7.....0...0....R7.C.F.6.8.5.9.A.E.9.6.9.3.E.A.D.1.2.8.A.4.0.F.7.F.3.6.B.2.E.B.A.F.9.C.E.9.2.3.F...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........|....i>...@..k....?0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.9.0...C.R.T...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........|....i>...@..k....?0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0..............<<...>.c..@0...*.H........0p1+0)..U..."Copyright (c) 1997 Microsoft Corp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority0...970110070000Z..201231070000Z0p1+0)..U..."Copyright (c) 1997 Microsoft Corp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority0.."0...*.H........

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Microsoft.VC90.CRT.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CFDFB365D8F581E80292124EEB97854F
                                                                                                                                                                                                                                  SHA1:7CF6859AE9693EAD128A40F7F36B2EBAF9CE923F
                                                                                                                                                                                                                                  SHA-256:F20BC224A6E3EF391C67FD91378E2EC9734E450EA30AC1D6B84E5ACB4AC9A087
                                                                                                                                                                                                                                  SHA-512:309D66CF8A3D026A00B90E635BE2535F9E13489CD35A89532D304AB3FF026B914AC508C4F1314BBD72CEFEC8303402F45FF63EA31E66CFE9480F586F8688720A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="b2f60c4aac5e14a70e51af1adfb7a3e3c8d78974"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Jqd8zw5i+qQ2JV5HoMPIqBhzMZM=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="a41203d30322a6320bfef2ba29f48899a5b1d608"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:ds

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Microsoft.VC90.MFC.manifest (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A4F947A900E60561C05F12ECC0AC9B8E
                                                                                                                                                                                                                                  SHA1:89965AACFF28DADDE79E09063B3421C1BEFFF041
                                                                                                                                                                                                                                  SHA-256:E85EA26D156723557653B22C10ADAEFDFA0D9615049541A74CDB968F146A5ACE
                                                                                                                                                                                                                                  SHA-512:38C54A752B53C60E7FE2A7C66F81757E3F047FD37339AC2B25C83B6A61320CE646C407C2AD90EB68E91702DBFFD0DD3C9A39FDDC2BA1DF6C187A525E013B7D32
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.MFC".. version="9.0.21022.8".. processorArchitecture="amd64".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="mfc90.dll" /> <file name="mfc90u.dll" /> <file name="mfcm90.dll" /> <file name="mfcm90u.dll" />..</assembly>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\MixImage.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E2738605A445A8C4239C6AAA18FF8908
                                                                                                                                                                                                                                  SHA1:B070124F8D0C55E036B984AB96BAA863FE6FB9AC
                                                                                                                                                                                                                                  SHA-256:7F390D921DD952DABA9CC3DF41D00302C77F89089D250C82CFEB0D68D95406CD
                                                                                                                                                                                                                                  SHA-512:A5F8512C51CE4691F4EC7C653FA583273AB21785E20E27E671044AF169BF2EA4CE42479C342A3FC17341FF3FE435256AD08CA4EE4FD9F66863090D42CD263221
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.. )o.s)o.s)o.s. Js(o.s .Is+o.s ._s?o.s .Xs"o.s .Os"o.s)o.s.o.s .Vs3o.s .Ns(o.s .Ms(o.sRich)o.s........................PE..d......e.........." .........................................................`.......V....@......................................... ...g...d...x....@...............*...*...P.......................................................................................text............................... ..`.rdata...5.......6..................@..@.data...p...........................@....pdata...........0..................@..@.rsrc........@....... ..............@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\NTFSLib.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EF3990748342BB53ED5FC3F84472C687
                                                                                                                                                                                                                                  SHA1:C69EECB3715C9ECE3300DEB29B827115A5B4B65A
                                                                                                                                                                                                                                  SHA-256:EE4CAD49258F162FA0DF29014CE46F489A38AC592CE8E201044857E4A3947CE6
                                                                                                                                                                                                                                  SHA-512:35643E8DA9C31C5E890AA143630F135257C43A1C12FCE0D2CF4A9B0264ED48E97E8D23A20157C31C97EDB0BFF17016952C0DB88E97E49FDBB389B015E5B1E0DF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.F..@...@...@.TB....@..u....@..u....@..u....@..u....@...A...@..u....@..u....@..u....@.Rich..@.........................PE..d...w..e.........." .........................................................@...........@.........................................0....S.....P.... ..........0$.......*...0..x....................................................................................text...o........................... ..`.rdata..............................@..@.data...............................@....pdata..0$.......&..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\NTFSUtil.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EA2B0322D0C86E82B2001AC152D5D0C9
                                                                                                                                                                                                                                  SHA1:E5DFB1E934010E1A89A427DB8F04C3775A83752A
                                                                                                                                                                                                                                  SHA-256:B3B56D9D5C6F12A5C41CC33CE4FA7D9B107ACF74A22DD285C806CFD15A9A630B
                                                                                                                                                                                                                                  SHA-512:D020A84C0E9FF179CCE8C85A2A46501E73AD7058B07C53834F99C9C81D4478F7079E7B079FCC1CEF307D2124013CF999D648AE273477A38C0B99528A5E2ADE26
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.Rwv.<$v.<$v.<$..$t.<$...$t.<$...${.<$...$..<$...$}.<$v.=$..<$...$i.<$...$w.<$...$w.<$Richv.<$................PE..d......e.........." ................ !..............................................'.....@............................................c...L...x............0..........*......h...@................................................................................text...U........................... ..`.rdata..3...........................@..@.data....g.......\..................@....pdata......0......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Options.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1D014DE0C32B01DBA026BEB74E49A2A8
                                                                                                                                                                                                                                  SHA1:A62DD33E2E1A66952A370743333F51EFABF3F835
                                                                                                                                                                                                                                  SHA-256:5290D120E1088F0A3E48F7FFBEC678AD6FAB79E3C38DA8BAD361E7FE1B87A346
                                                                                                                                                                                                                                  SHA-512:506C850940F402C33F5448052C3C5571A0D274FADE5FE4D76832C7EC6449AF4273EDC16313B4B0A55FDA1C5175748B6879ABD3AA568311E89D5375C762BC276F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yO..=..=..=...aT.?..4VW.?..4VA.6..4VF.5..4VQ.:..=..y..4VH.8..4VP.<..#|V.<..4VS.<..Rich=..........PE..d......e.........." .....L...4......@Q..............................................F.....@.............................................f....w..P........................*..........pb...............................................`..8............................text....J.......L.................. ..`.rdata... ...`..."...P..............@..@.data................r..............@....pdata...............t..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\OutlookDataBackup.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DCB51FD170BAD388A5F28343E2875AEC
                                                                                                                                                                                                                                  SHA1:5A4F7DD3CA546A0818544CC195892C929736CB7B
                                                                                                                                                                                                                                  SHA-256:AFBBEB605109AE168A447D749EACC2F43D639A92EC380118E85AC83BE5855E69
                                                                                                                                                                                                                                  SHA-512:B197B62F288278A6E5456566A2900B6A64AB27AA42ED0C39239717B578531891D786876A64FADBC540A725E5561167C9757DC09344645F8A0600697D02D1CF31
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.v.x...x...x...q.......q...u...q...1...q.......x.......q...~...q...y...f...y...q...y...Richx...........................PE..d...p..e.........." .....P........................................................./.....@.........................................p...........P....p....... ...@.......*......L....d...............................................`.. ............................text....N.......P.................. ..`.rdata...0...`...2...T..............@..@.data...Xu.......$..................@....pdata...@... ...B..................@..@.rsrc........p......................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\RemoteCall.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E7878466CD2C28A72C0B9813D9726455
                                                                                                                                                                                                                                  SHA1:CD01423ED460736675311E7B9105239119ABFCC1
                                                                                                                                                                                                                                  SHA-256:30EDB557487D9DE2101C294055797B8825F777C6A4ED4A6895E468A274366C37
                                                                                                                                                                                                                                  SHA-512:BC4592DE10D0C4BD1B7EB1E32B93D50FEA83599188AC1238AC8892D07BC633E1EA096D854DE35F8BA511C234E74DDB9A82155A87C7DBF3595901103C47CF2E5C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H!<..@R..@R..@R.....@R..8..@R..8..@R..8..@R..8...@R..@S.l@R..8..@R..8...@R..8..@R.Rich.@R.........PE..d...q..e.........." ..... ..........................................................kZ....@.....................................................d........................*..........P3...............................................0.. ............................text...h........ .................. ..`.rdata...f...0...h...$..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\Sqlite.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:42DA2BE4B3D69401E9401FBEEF156E75
                                                                                                                                                                                                                                  SHA1:DF5C1735E2A081F8206B862219E69F879B620A76
                                                                                                                                                                                                                                  SHA-256:45DB1ADCCD9279BDEE841FB17FC7709C4F67BA32CD4DC5A5FB42B50CA9F0FA4B
                                                                                                                                                                                                                                  SHA-512:80DCB0739C6460FA4ED3358814406A5178E492FFB732EA33B7D794B76634F67DD38A8834FB1E28EF3502484F74E27B48B0063A55BE41E46DA31E399B1AE2A287
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-.`.i..Yi..Yi..Y..Yh..Y`..Yh..Y`..Ye..Y`..Yn..Y`..Yn..Yi..Y...Y`..Ym..Y`..Yh..Y`..Yh..YRichi..Y................PE..d...n..e.........." .....f...........k...................................................@..........................................!..L...0...P....p..........Dj...J...*.......... ................................................................................text...8d.......f.................. ..`.rdata..............j..............@..@.data...@....0......................@....pdata..Dj.......l..................@..@.rsrc........p.......0..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\TBCloudTrans.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8490B842F25CE86CAA2834B14571595D
                                                                                                                                                                                                                                  SHA1:544899CA0A1E1E8F0534EE5DAF047B6BF5895213
                                                                                                                                                                                                                                  SHA-256:E2DD40946E2BEF17BE756FE5B9299AC5EF375E63E3EA1F0EAF79F8415274EB14
                                                                                                                                                                                                                                  SHA-512:C2A0989EA224CA3D7CDA1BD92F8D914E8DEF89117B57E435E16130380EEBAADFCBA1B3D8A920840B607A0482E4936E5F12F60278B16DEB45A81D6AB03EEA4FDD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wsr...!...!...!.n.!...!c..!...!.~. ...!.~. ...!.~. ...!.~. ...!.r. ...!...!...!X.. ...!U.. ...!U.. ...!U..!...!U.. ...!Rich...!................PE..d....>.d.........." .....h...........5.......................................P......O.....`.........................................`... .......|....0...........[.......*...@.. ...P...p............................................................................text....g.......h.................. ..`.rdata..6,...........l..............@..@.data...x...........................@....pdata...[.......\..................@..@.rsrc........0......................@..@.reloc.. ....@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\TBFireWall.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1469E7DC93D1BEECF0D3204D279F6632
                                                                                                                                                                                                                                  SHA1:B60B05031F9BBA1603D67B8BD72BA02151E94594
                                                                                                                                                                                                                                  SHA-256:7683A94CD42F5AEC59823EEA36243AB832EA169C8491ECF3FBA5E0E6754B303C
                                                                                                                                                                                                                                  SHA-512:14569D70BBF44C23B139DA316A288F998122965E23B972CEB47F1A9A2361EF328AAF081C3F5A98B463AAB1A3CE91E6098C0613FA9D49F059DF0CE4A6D45D0696
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|.O..s...s...s..e....s...r...s..e....s..e....s..e....s..e....s..e....s.Rich..s.........PE..d......e.........." .................V..............................................W:...............................................{.......q..P........................*......P....................................................................................text............................... ..`.rdata...k.......l..................@..@.data....6...........b..............@....pdata...............x..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\TaskMsg.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:67019047BEB2BFC991ED3AEB781191CF
                                                                                                                                                                                                                                  SHA1:BDE2060B9007C18F9998643F197E2BA351605AB9
                                                                                                                                                                                                                                  SHA-256:A3B092FD0C92408F8F572D1A9155499F8B9689DF8AFBA182625E1B29FF44A0FC
                                                                                                                                                                                                                                  SHA-512:E1DAD44026CC9B74A02CBA6D13CD4F3ACE7D293F3257CD9C5D6989D0F6E784895E2993A4FF393867A1A83F85BA0D010B7B04045C9F911B52C546AB1218573297
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3D..]...]...].......].......].......].......].......]...\..].......].......].......].Rich..].........................PE..d......e.........." .....6...........;...............................................C....@..........................................l..f...hd..d....................h...*..........`R...............................................P..0............................text....4.......6.................. ..`.rdata..V....P.......:..............@..@.data...p....p.......X..............@....pdata...............\..............@..@.rsrc................b..............@..@.reloc...............f..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\TbService.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:791F0D379A6D71922EED737F8C3CB735
                                                                                                                                                                                                                                  SHA1:96E5E950FAD290432405403C513871464FC30C33
                                                                                                                                                                                                                                  SHA-256:2A1EBD40AABEC82BDDEB9F403879EBA8CD41E67AF3298958877FD103111B28CD
                                                                                                                                                                                                                                  SHA-512:8C9D3F312752530337C4EE8796330D269348AE95C3DA251C65109FCFBD79A23F187886422B4774867BCA0E55D31D86B2B2954BB893EE39902972475CAFB280AB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%.d.v.d.v.d.v[+bv.d.v..av.d.v..wv.d.v..gv.d.v.d.v.e.v..pv.d.v..~v.d.v..fv.d.v.6`v.d.v..ev.d.vRich.d.v................PE..d......e.........."......b...|......xH.........@.............................0............@.........................................p...i.......................+.......*... .......................................................................................text....`.......b.................. ..`.rdata...:.......<...f..............@..@.data...h...........................@....pdata...+.......,..................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\VSSSrv.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:37812BBF0F9DFB50477C08C19E3B243C
                                                                                                                                                                                                                                  SHA1:ABDF2E88E4C484070DFA592282571F5B1DD67F3D
                                                                                                                                                                                                                                  SHA-256:E0823D6EB1F28586C52749A6BC3FFC2C0D89D0BE5E92DE73FACA491545F3149D
                                                                                                                                                                                                                                  SHA-512:6BB361B3282308A976D105F08CFF1E54ED1007970F74BABB590D905E887256237249D8BF13513F58120B66E49331E987930726394A7472931E5B475BF8BC3368
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y/...N...N...N...t..N...6w..N...6f..N...6a..N...6q..N...N..zN...6h..N...6p..N...6s..N..Rich.N..................PE..d......e.........." ................L........................................ ......!&....@.............................................d.......................8".......*..............................................................h............................text............................... ..`.rdata..$...........................@..@.data...............................@....pdata..8".......$..................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\VssEaseusProvider.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A132B3CCED8CA34F03A4B9E96DC99047
                                                                                                                                                                                                                                  SHA1:3C490D2D8A7AA577DB5E400E58B7A7176A3EC0A4
                                                                                                                                                                                                                                  SHA-256:17A49075F1A028723C70AE6792020FD20F35DD88ABB24970AA1039AC3934BBA8
                                                                                                                                                                                                                                  SHA-512:B99EC16890E9CA1D0F8EC8ABC4A428A2992BA68A8B24031094BF0D9DE37C9B5BC3F0325612E2682F900039B0E3731FCE8A4D209CF43273A0870C6F4759D6A0EB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j^...0X..0X..0X(D.X..0X.s.X..0X.s.X..0X..1X..0X.s.X..0X.s.X..0X.s.X..0X.Y.X..0X.s.X..0XRich..0X................PE..d......e.........." .....b...v......pa.......................................0......L=....@.........................................P....................................*... ..\...`................................................... ............................text...T`.......b.................. ..`.rdata...E.......F...f..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\VssEaseusProviderPS.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EDB1183017658C1A00FBD604D84A2B8D
                                                                                                                                                                                                                                  SHA1:B4EAD4271554CB48D5F72859AF9630E90B13E848
                                                                                                                                                                                                                                  SHA-256:4CAABE7B5F752AC98956A2B824A92099EFFFFA00DEDA4A53D287601F2CD2BA10
                                                                                                                                                                                                                                  SHA-512:36990F37CCF05BD411FB6476A38F114F0070EF49B874909675DD9761622DC13DE5527A95ED12D41B7B612E11C07A23A537E5D328AA9F482C768FB4DF74133EB0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!K..@%..@%..@%..8...@%..8...@%..@$..@%..8...@%..8...@%..8...@%.Rich.@%.........................PE..d......e.........." ................X...............................................0O....@.........................................`;.......5..P....`.......P.......(...*...p.......................................................0..h............................text...!........................... ..`.orpc........ ...................... ..`.rdata.......0......................@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........`......."..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\VssFreeze-Server.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7A025842F50D9338AD90F256DF2E145E
                                                                                                                                                                                                                                  SHA1:EFF399FC0F79C9D9C5D880F1A199E5A652EA7496
                                                                                                                                                                                                                                  SHA-256:810BF0BB4E7887C69C862D2AF3C6EC55594A7BFFF73952C4DF9BDECDE0822882
                                                                                                                                                                                                                                  SHA-512:EAAA9241683D286D7CC7D539AFC771808A08A76BB5D997752DD502AEA5D268B5753C0B0F9C5C8E605A9BB30D2CF7E562B0A97901FD33555E6BB58E15A32E79F5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.g.f.g.f.g.o..l.g.o....g.o...`.g..-..e.g.f.f...g.o../.g.x..g.g.o...g.g.Richf.g.................PE..d......e..........#......`.....................@.............................P.............................................................. k..d....@..........Xk.......*..........pt...............................................p...............................text...._.......`.................. ..`.rdata.......p.......d..............@..@.data....F....... ...l..............@....pdata..Xk.......l..................@..@.rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\WinChkdsk.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6622B6FD996E03F06DB87FCD74EFB643
                                                                                                                                                                                                                                  SHA1:90F12EDCFAB8148439AA2FA836A59404C585FFAD
                                                                                                                                                                                                                                  SHA-256:F21C6B0E7CC990AA3BA16CD6F73A7A50FF305ADC87A646DE19DA6EE360758F5B
                                                                                                                                                                                                                                  SHA-512:2CB9108A79B743D23BA33ADED707CCCA66DCC648DB5E2822DBD861FE52B0E5D89240FB3470EF9C02E18E2FD9E5E8EE0D4C9B8848E55278FAE3F98AD53BFDB698
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............p...p...p.x....p.....p.....p.....p.....p...q.T.p......p.....p.....p.Rich..p.........PE..d......e.........."......\...F.......].........@....................................9.....@.................................................$...d........................*...........s...............................................p...............................text...nZ.......\.................. ..`.rdata...2...p...4...`..............@..@.data...0...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\XmlWrapper.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:687744E0581A685BAC8DF00D547C6CEA
                                                                                                                                                                                                                                  SHA1:C0F078643605D8F5F258B3E4E8E894EC326BE8FB
                                                                                                                                                                                                                                  SHA-256:874E52002140EF7DD2282A522A19321FFA56F3BDC2F24E83A6A289FCE3FDE535
                                                                                                                                                                                                                                  SHA-512:73BD7CF8231392379BFA4E6C65BCD10A6F42B840B1FA3B5B144838BDCEE5C84C311D159AB5776576FD5AB86E9077ED1F67CD36048FD0DAADE8B134C1D616348C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L.."..."..."......."......."......."......."......."...#...".......".......".......".......".Rich..".................PE..d...W..e.........." .........R..............................................0............@.............................................*.......x...............@........*... ..P....................................................................................text...o........................... ..`.rdata...9.......:..................@..@.data...............................@....pdata..@...........................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-console-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:420323D0E507B86DA548D20B94F3ECAE
                                                                                                                                                                                                                                  SHA1:9F3876284BF986E627ABD7248E86CD1E1B1ACA42
                                                                                                                                                                                                                                  SHA-256:4185280EA58EA63579BDC141BB5263DAA42EAF105B8A81E4C7CCE89DBA331957
                                                                                                                                                                                                                                  SHA-512:AB331A9FAC890E8959218C65B9CF233C8D18573E1DBBB7D798A761131F5FC1F35E448919BD8F2D5A4C0999BEDBFB1BF6E85A7A6C766FCEE8A82211E3589435C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...Y.=i.........." .........................................................0......}.....`.........................................`...,............ ..................."..............T............................................................................rdata..P...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-console-l1-2-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7A55E51D07E1F15221EB11479ADBC53F
                                                                                                                                                                                                                                  SHA1:8D8E2BEFF4DFA78372201B26A67B9DC4B116290F
                                                                                                                                                                                                                                  SHA-256:F901B0BC8C00B3AFC80E151E6F54B18F7672F932602C304FBFEEDD5AA3AD63C8
                                                                                                                                                                                                                                  SHA-512:E89C0E45014ABDAF7548DE0352949C4AD496D97CAD2F9E2F6C83A90F853B7B71354B9ABBB957EFF89076DF79BDC9CC1C431B6F35875550BFB4198C3A68124197
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...uQ'..........." .........................................................0.......4....`.........................................`................ .................. D..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-datetime-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F44C562F058C83CF98CB51A65410B5B9
                                                                                                                                                                                                                                  SHA1:CB633F131891380B8B5FFA87B332337FB24C5EBC
                                                                                                                                                                                                                                  SHA-256:89C3B43B4BF37D04253A8D565F055A29BBC0D84A473646D4F0787C96DE90FAE8
                                                                                                                                                                                                                                  SHA-512:6D52E929DA91A95E7CDE24EBF4E2326356442E3F10296DF8FB3F975C6EFAE3201605F95B413F827450D16BC14105CA2E6B1D9ECB45B944BCF72E1689039EBFB5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....Ab.........." .........................................................0.......Q....`.........................................`................ ..................."..............T............................................................................rdata..4...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-debug-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6CCF0CA512B9420990C22D462ABE3B08
                                                                                                                                                                                                                                  SHA1:4F2F516A90CD06FB132B794762872BA19CA51CBB
                                                                                                                                                                                                                                  SHA-256:F8F460FB6A3AE59DC83E8C398757C9D4999A54FB14F5E4B33B09140158AD0762
                                                                                                                                                                                                                                  SHA-512:B75BD6DF0A4BD2754223BB5821A3C6D3DCABE1C41630822106E12235B9E1B3C0155F5CD41AB56FF0D0EC05864289F2EF1FB1D8C58BE77C1AE36D48E89862A66F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0...... >....`.........................................`................ ..................."..............T............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-errorhandling-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3894F6DE1588840F9282246D527CB077
                                                                                                                                                                                                                                  SHA1:BED0EDAE7EC79A72077913A3620337CC5E854067
                                                                                                                                                                                                                                  SHA-256:6199098A9054AA37578BA1547028424B1026AE604D3F4F1F745FB88B60B1AC27
                                                                                                                                                                                                                                  SHA-512:AF4567489CDEC971656E1BB4BCE0CF6AA71CA7053B47ACBCD78DB82584525C846C0456D1CFEA101D61D5F7DD5A13FA26DDF4E7B81EC8A917ADD8DEA07CF4436F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....:.[.........." .........................................................0.......w....`.........................................`................ ..................8!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-file-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F753699EA5569C33BF9ABD2D766445C1
                                                                                                                                                                                                                                  SHA1:43BA6C336CDBED435A73137201F7EC1C8A9E25B2
                                                                                                                                                                                                                                  SHA-256:EEB1780941F9E74C8F7E176D42B4DF1AE8AE27BDA5C6C2F569EC64200D3F1C88
                                                                                                                                                                                                                                  SHA-512:5DCFD22BF1D504157390B9B90D45E61D3407DBB6DCB65B1B363C06C027A8CF74FA1533DC479B422EECDA070032B9AF7B24893372E0D2B69D4E6F0D6C20A1CF18
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................@.......W....`.........................................`................0..................."..............T............................................................................rdata..(...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-file-l1-2-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D0842AC13C33E2287D8ADFB16BC83E7A
                                                                                                                                                                                                                                  SHA1:68CFD86A437BD755C2F06E59FD2BA87026D9BEC1
                                                                                                                                                                                                                                  SHA-256:79F0CCFEC37C99A53FA333C95ADF94420765366D040EEA78A76C545C89708FF6
                                                                                                                                                                                                                                  SHA-512:88A5E680ED5E42452D0B7F638327BC38E88AF835ADA391A11C44C43FAEBEE040D9D30227DBA12231ED4FFA0C8FD3CB461F5A682D48E40A9C29EC410F069CA346
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0......o.....`.........................................`...L............ ..................."..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-file-l1-2-1.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:ABC63F8B93596B6DDBBF5FE1FF97913E
                                                                                                                                                                                                                                  SHA1:CC5BAD92ACE5DCC684E0044B10DB2C5C950162C1
                                                                                                                                                                                                                                  SHA-256:5DCD30945AF1FF0FE4D229CB37A2FAF9461F5DAEEAF683D375379C1D4BBF00E4
                                                                                                                                                                                                                                  SHA-512:8266D6C18833342CD766F85A8606FC874F6F48F759D496EF70A2D27AC0158783E19EE9AF30F43D4F7370BAF36F39E21FC9F6058FDA055ACA7AC025AAA4AAA3BE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...T............." .........................................................0............`.........................................`................ ..................."..............T............................................................................rdata..0...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-handle-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CE4FA9B6076007756515717B711AF9D4
                                                                                                                                                                                                                                  SHA1:7AE7A19EDC7018696786C5CF793372DE3A7FD836
                                                                                                                                                                                                                                  SHA-256:412334E6F0F829A18EA31A06F380D3810C83292BD0691FBE8588BDFC07DD3A20
                                                                                                                                                                                                                                  SHA-512:62A9987289DAB6227391B9D5D02D3BAA23F2119B4CA59160759C7D7AB9D83016477DCC75DBF4CAC8D64BBD478AA0B53C791E01FFBFE8E1ED565A641BBC3BD668
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...>G.j.........." .........................................................0............`.........................................`...`............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-heap-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CD80166720668870FE271DB3A633F897
                                                                                                                                                                                                                                  SHA1:8A7091BACBF71CDBEBF2AC67CE68119833DB6B5D
                                                                                                                                                                                                                                  SHA-256:3DE73E2ED94F3D19531583F2C623FAC6BCE469A2DAFB36861A417055639DFCEE
                                                                                                                                                                                                                                  SHA-512:90A007C2D0132DE5835EDA3D5E89B6C97587217FFB0D0D7D24668BBE8872B1A98DB1C4D13ECECE03D042FAA997628BD73C60ABEBEAC771F1B07CF3FEA3CB55AB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0...........`.........................................`................ ..................."..............T............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-interlocked-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A62B72F523792F2844794AE3B376FC86
                                                                                                                                                                                                                                  SHA1:16377BEB178E4E3D898C3CD1A39147FCD862D661
                                                                                                                                                                                                                                  SHA-256:B6AA2F51B31C16D7C4474F6C42F16761C4C898A242CF91E93BEDD82A41F7CA1B
                                                                                                                                                                                                                                  SHA-512:99A93921C91FF5F61D367FE244EFC0D53BA5A495B8D8C1B648CD52CEC772FD61DC734EF423D060C7D34E2FD3B6408FA3CA8154B0960A10F47962414559586DC6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...*............." .........................................................0.......,....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-libraryloader-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AD262469A5A85FA1B1B2922EEFAD6823
                                                                                                                                                                                                                                  SHA1:123B05CF8A10437C9B6DB7357A1609F19B31D841
                                                                                                                                                                                                                                  SHA-256:A92B9E28CBF9B617D196B28EF8D7C2CDD311D2B48A41B08E7B5566B8BE04151C
                                                                                                                                                                                                                                  SHA-512:ADCF83D42FC8BA1F7FA968D6D7EF9C50AB6A1BE49B8D998660C5CA04D286C6188E1B90D7AABBA56E649415EB00C232AF9A51879ADB09CAC51C4F5D6AB6FFFB2E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0.......x....`.........................................`................ ..................."..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-louserzation-l1-2-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:39475799BFAEE65894F94A0F15D0D1FB
                                                                                                                                                                                                                                  SHA1:F7A4E3DC3FB5133C53BE4F1B7F1956D85F6F392E
                                                                                                                                                                                                                                  SHA-256:2D9F380091506EB22F0E92C68F6D8641C06FA92F733494FEE9836FD748A294D5
                                                                                                                                                                                                                                  SHA-512:7156D60EE067F99D21C9D88883C90E8C83D75729807CDD77A37D74D6B15A8224D93189C1283C8756EF18A965BB8A11AD2DA84BB6FE8ACBFFB83503FE6B5355A1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0.......H....`.........................................`................ ..................("..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-memory-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:97927B64D4A38E91987FCED5D39D8E79
                                                                                                                                                                                                                                  SHA1:79834D99237FACABBA6ADD6E8FB083A4607D4B15
                                                                                                                                                                                                                                  SHA-256:5B19240AA954733C60F56482BE91089E552295292D7A669418E10215C0F7830A
                                                                                                                                                                                                                                  SHA-512:6A14D66BAB6B16EF443964FB309CC42BA7FCBFC6AE746F91AF0FD748C8FDCCD638F478C807FFDB066061B6B0BD8471700992DC983446E815B4FC9731C08CE454
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...f092.........." .........................................................0......S.....`.........................................`...l............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-namedpipe-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6A90021A45818AFF3390438EEFC9B787
                                                                                                                                                                                                                                  SHA1:84E2A69F2F6C0DFCCA296BCEE032C1E0C19641BE
                                                                                                                                                                                                                                  SHA-256:A8515699A009E0E028B44851C02AA0F794D1D1B41A73772B98573754424E1025
                                                                                                                                                                                                                                  SHA-512:DDF441775EE6FA741A96F19D2D4EF208CE9B545672CA4B68C4CDDAA6C1D6032BBC1AA4E58C087CEA6AC8C2A4F69BD54541B83EA082F2F32E76F41C22C9C990B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....%..........." .........................................................0......Y@....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-processenvironment-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C0C1F885BF86C487ECF9608CFAEA3447
                                                                                                                                                                                                                                  SHA1:7AE85086713423333B1A4DC45DC79262A7B714BE
                                                                                                                                                                                                                                  SHA-256:E1E33D9F38F5E477C9763A7367B31321AD8E8ACD572CA623EC84421D17B511E6
                                                                                                                                                                                                                                  SHA-512:367F5DBFA06B534EA12FA19FE0911E1FA209668A40306632823B71F154B6DF28A7AA09805BF88BE7D7076E817384F450209D47830476B7A495C7F701CC3F61EA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0............`.........................................`...H............ ..................."..............T............................................................................rdata..x...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-processthreads-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:89B1B41BE1FCD4AF04D1D55172C34719
                                                                                                                                                                                                                                  SHA1:E156CFEFD0350C84AD3E08CDC1BD283299CDF6D4
                                                                                                                                                                                                                                  SHA-256:33FDD447A19B761C7017F599DAB6C1EC14AF6AB139F81959E93E85C7A543C5B0
                                                                                                                                                                                                                                  SHA-512:EC3D3026AF951C4B2086E4C9E7741E90F7E64199564BC105F5847B08A70D028054240FCCA09EEE412F10E9681457D7DDBA85C77A8D7ADFE51F2F3323C41B3301
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...j............." .........................................................0............`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-processthreads-l1-1-1.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:915F1C029D8B51CE579FE6F5330A77CA
                                                                                                                                                                                                                                  SHA1:1629E4611E444FCC2514C522E6AC626860F370A5
                                                                                                                                                                                                                                  SHA-256:8065D56D1442DE48A43B98FEC8A9788EE144D997604180629CE303EE9BA53D8E
                                                                                                                                                                                                                                  SHA-512:E0D6900B9D8BD496D41C8CC538054E39E20CACA88B8C54B52A2EBC7F01B104DB25D9FE2D5FC2B269040CF75AD1C35759D7930BE874F034191D03E0DD458E3235
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0.......c....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-profile-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:98C7553268014D1A9B4B451EC44292E4
                                                                                                                                                                                                                                  SHA1:07B03A88258C5FC97358720CF4142698A3C2022D
                                                                                                                                                                                                                                  SHA-256:AA48FCE35A1B7AD8C03703C5821DADAA69D1773000505D988B4C0611A9BBFE2B
                                                                                                                                                                                                                                  SHA-512:09AC5444EAC1AF2717C675C8B23F4B13AF4AAA2E0E61C1B2BFE32DDDD67B610684CB39F3FF475C95ED9EC9314FB70D3CE5E5464ECC56FBC2E1E96CA5B6D43EB3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....f............" .........................................................0......W.....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-rtlsupport-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8786314584FDFE3FEDF85EAA7EB5C008
                                                                                                                                                                                                                                  SHA1:918CE4C53463092C1B90A62BEF36C5B1BD6D56C4
                                                                                                                                                                                                                                  SHA-256:95ED852901E3F0384334A8363F97FAFA0004B97A9D7B3E0175100B9ACD1D4166
                                                                                                                                                                                                                                  SHA-512:43E4C44DF4B1231D3C1A2E6D9678E7CC0152D497ADF36E0C464B92530D2358FA303B90EFCC5E35ED9D789ED3D1ABB71BDAA1EC68C2B68FF41DA82613ACFF1620
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...._............" .........................................................0............`.........................................`................ ..................."..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-string-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1F52092CB4538F17F3EA7D62DB31BE0F
                                                                                                                                                                                                                                  SHA1:C9282A2D4B603367A6717A9BC3D59D7DA784B967
                                                                                                                                                                                                                                  SHA-256:876EAB922FFFF0DC4314ABCC212580BA8D3346B45EA2E51930C7CC8D6C5A43EF
                                                                                                                                                                                                                                  SHA-512:92C785BB1988EA3C61E0D2E031D426EAE87563C56741F82F0240B3BCF463EC733BA25AA1A7A1D776F1C14672266A22A997867C578A91D3B270696ED1DD7C3B21
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....<.........." .........................................................0.......Q....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-synch-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DFA89D4A72751091108FC3C08588D2B7
                                                                                                                                                                                                                                  SHA1:95052FF76ED7A19E07AD3B322A6EE8CC8340BBB8
                                                                                                                                                                                                                                  SHA-256:D517A0B9673EEFDCFC83FC8E03DCF5057EB1689B94E67D493AF0C16728486245
                                                                                                                                                                                                                                  SHA-512:7BA8465CD431C21858BA256438DDC4EFE5A20F48D320A3B97A9F1FD2C7F9A782B1DF8A620438A7A6FBBF0FA4A2B5EA4072DEA2575ED3B9BFC0187DA2093E6E75
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0............`.........................................`...X............ ..................."..............T............................................................................rdata..|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-synch-l1-2-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F98687F24C22ED699DBC3721CDA79044
                                                                                                                                                                                                                                  SHA1:67F97F2DC22A76C533435E9F3EED4D43C8265D90
                                                                                                                                                                                                                                  SHA-256:EA02309A2DE376DC9321E2A1154ABFE39170762AC24E5925D5FB8F3E726D723F
                                                                                                                                                                                                                                  SHA-512:64C0CB361328F4D2C4A6B15B4E345D6F3C83C195B2AC879712F443E722C6694A5A16FBDCA2B7CF287081FFE093EE0D01573B22D3241DE03CFA195BBBD6D3EB58
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0.......-....`.........................................`...x............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-sysinfo-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0BDE6DB4EBCBB3E639A0439B19559D34
                                                                                                                                                                                                                                  SHA1:8D17B3CE9621C690313806A82F1125E9EFCE30F2
                                                                                                                                                                                                                                  SHA-256:6D18EC951741BD2738B62C5DCCED6C9F8B9622238A26C4802556BDB8DF8A1DD0
                                                                                                                                                                                                                                  SHA-512:E2D6F60AF8DD94A060824940E4389896D3CE219408E262FD05D25FB25FBAC58C47EAACA2BC37F02EBE7339DFFF7C3E4E7098959532C3B8B05EA0110C13F9DC00
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r............" .........................................................0......;]....`.........................................`...H............ ..................."..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-timezone-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7B2CAAFBE6B2C3D6CBF232610DCCC034
                                                                                                                                                                                                                                  SHA1:ED3F3CB464C779F224729C62ED2A4318F8D0AEFC
                                                                                                                                                                                                                                  SHA-256:BA0AFA1FADD4429693538AA2E85230EDCCC2E481F80B89666907D108D31BED8C
                                                                                                                                                                                                                                  SHA-512:E32C3B6F31C9FE31381884AE683178BFFACA4A88F030335A4502DE42432CC014337F5AC2C2ECB726AFEA15CA3F4C52C26D4024ABED1A4187C4773B8C6FF73977
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....Y$..........." .........................................................0............`.........................................`...H............ ..................."..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-core-util-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:04EDE6B39122AF646BAFC812BEB843C7
                                                                                                                                                                                                                                  SHA1:8E7F49B06BC6B5D55007102E8BB4558900E96B57
                                                                                                                                                                                                                                  SHA-256:1C8450668F49FEE4DE8559F312F7CAAF7DA26216B92D5A4C26493D8188DAD9EB
                                                                                                                                                                                                                                  SHA-512:FD348E7E90310EA1E14686EA3A3BA3B3584E2EC1BC659F40F70F87DD729530868C44FAD40D941A5724A4FCCAE0A7F1AD3E45F5CE9914E4DA055E9BB9A8B2AD10
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0............`.........................................`...<............ ..................."..............T............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-conio-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B39818632A1E37FFF6BF0DDA3F2C1732
                                                                                                                                                                                                                                  SHA1:8F49FD8E54A3FC93B89B75B4EF1741E08880DD29
                                                                                                                                                                                                                                  SHA-256:24D1AB93B6799378C110E0DD164D82C39AF1B8FB50BCCB754B1B52B3B68752A1
                                                                                                                                                                                                                                  SHA-512:085902A0AFA9B6868C0F7D91B2C45A5A780EE154A0A39BF733A27D4CFFFE0FA9B4CAB91503EDB01344CC5B664C768F72063EBDF588AB5019D1A53F2D43F0E8C4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d..../}..........." .........................................................0......R.....`.........................................0................ ..................."..............T............................................................................rdata.. ...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-convert-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F1966E566459389D610B3773C3E065F1
                                                                                                                                                                                                                                  SHA1:E123168541D78E792D8CDBAA6B473F28C1064954
                                                                                                                                                                                                                                  SHA-256:DB128A378C682A0ACD5FB4D074B45FAD33AB57E70637F3EFF917562D8100923A
                                                                                                                                                                                                                                  SHA-512:A0D2F959CD28B48791D60BF7488AA26231439C83DFC9E474F17144963BC57F143FD3E0F1904B63948334D3A83B9A5BDD3B2DAD81F2E6584303C1C9BFAA9A9C78
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...x............." .........................................................@............`.........................................0................0..................."..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-environment-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E2686222CF81F2ADE726D5B7D61717F4
                                                                                                                                                                                                                                  SHA1:8ABAF7CCC964A49A0A49D3A2887FFAC7A3DDB64A
                                                                                                                                                                                                                                  SHA-256:58B2B1272AF9351306356A097499390852EBA5C429A148283DDC80117980C13A
                                                                                                                                                                                                                                  SHA-512:DAF4149ED1FF432970B8FAEDB3120DF24E9BA424B0D0668A5BBE04BFC0F3390DF718328FD7665F3DFBBA0FDA037032F5222CA6947B4879DA544B1965696506E0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...g P..........." .........................................................0.......w....`.........................................0..."............ ..................."..............T............................................................................rdata..R...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-filesystem-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:25586E8F953667BBBB2A7F2E25949808
                                                                                                                                                                                                                                  SHA1:9597DC051C9EF3C234D03C5856402964E8E36110
                                                                                                                                                                                                                                  SHA-256:C6FF48E6EDB727FCA3971DB306E617462A4D692CBBBE2693D447F072720ECEE6
                                                                                                                                                                                                                                  SHA-512:AF607633CBDEBAD127AD804B4C54957E74102D0F4FDE2F3229E163FDA7EFD9BFB923E812D25CDAC13332FD7F6584830BE8CFAAB4C84CCD78E5642A014E5A8B93
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r..x.........." .........................................................0...........`.........................................0................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-heap-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:08F8E94021B233848DBC1624CB17BB7A
                                                                                                                                                                                                                                  SHA1:8BDE9C791550226A6E139D86279D22D12054437B
                                                                                                                                                                                                                                  SHA-256:7ECBC9B895AD5A70CCC45E85D3EE401AE0517B71040354351B63D00814D5428A
                                                                                                                                                                                                                                  SHA-512:C8ED343189F6F0FBF89B060FF62053BBD17540D4AA7358B355448C57F6D18F988673806C3E4D103C47A9B09CBAAF0829EFC1C6D779F5B563E9BA326C5413B7F5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...h{............" .........................................................0......@I....`.........................................0................ ..................."..............T............................................................................rdata..F...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-locale-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:54A1DED1160D8E7A02307B63C191E42E
                                                                                                                                                                                                                                  SHA1:BE3DE75C0FCC802D2CFCB759288313ABCFFD2EB9
                                                                                                                                                                                                                                  SHA-256:ACC5C813E40E55C5C242057AB15F3D9049850D7345D8509F7044BC905DD3AA3A
                                                                                                                                                                                                                                  SHA-512:41A1ED1393857B38137CCC91C5519DBF2D054826515F321F2CBB86A21D7086AD5098FE6A2DA9173F32B8D7FCC41A893C742DA0FDA99F8BA179254CD2097C59A0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...+P............" .........................................................0......".....`.........................................0...e............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-math-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B3937AE7171B6B3D02166BFA9CD6CA9E
                                                                                                                                                                                                                                  SHA1:949C7DFFEB2A0957F741AF5CADE887D8FA0B89EB
                                                                                                                                                                                                                                  SHA-256:84B21FD1737B7D8953E22BD4DF29CD933E3FC0A07D134598BF062F7ECF984AEB
                                                                                                                                                                                                                                  SHA-512:00EFD098585546C25B4F8489673B8707E411FEB1CA0936F4FFB9FFBFDF160218EEF8E6870EA85CDB659C2FC243A473C28C7BD9B9D708163181BC9EB85EC416BC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...IV............" .........,...............................................P.......d....`.........................................0....%...........@...............0..."..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-multibyte-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:18B875B9075AC3BF21FC8DB56D774ED3
                                                                                                                                                                                                                                  SHA1:DA8802907A4DB504BF694465BBCF4A1C5BFC49BA
                                                                                                                                                                                                                                  SHA-256:343B5FED7783130B1E96C524E8CC84FD0F690A66614756A5EE117B35AD1087E3
                                                                                                                                                                                                                                  SHA-512:F85CBB31A24CA5DDEB3589889D23C415A9798AE8F80F5802A60075AC04A23904E13921DAAB311210169AE11716DF4CDD9605F930E84EECE2C70E1D33FA06AED4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.../..N.........." .........(...............................................P......n6....`.........................................0.... ...........@...............,..."..............T............................................................................rdata..$".......$..................@..@.rsrc........@.......(..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-private-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:25714A7D24E8D75B240A618668BF55C6
                                                                                                                                                                                                                                  SHA1:D54573065A5B21CFBBF3FB9F07B172FC22B4C2DC
                                                                                                                                                                                                                                  SHA-256:41B7A63FE1FE274F3B7C74A75602BFDF91528E01FACC014F5C6FDA7322B54DE3
                                                                                                                                                                                                                                  SHA-512:6532080A54350492774D806A6B9F799CA5817067E999CCC901BA5D7949E89CF24B7A50999646D9E71023EEAAFECC859E46F9A1B1F4322C5CAA14CD70FCDA60E4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......F.........." ......................................................................`.........................................0...T................................"..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-process-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:09D0BFE93E1F295C533DC360A3490167
                                                                                                                                                                                                                                  SHA1:5532422719BB183B92923AA1CB03D05F8CFDE61C
                                                                                                                                                                                                                                  SHA-256:9AAE2D8C26F613E368EAD960A101B05BCDA63B0109BD24A6AAAB8C45EF1AAB93
                                                                                                                                                                                                                                  SHA-512:60CE0B8ED8F1D119897FB0B8D0AF1D615B88E672E7DB6FB8B02E2DC50D93EE2273744A4BDA0C06550250595AE570C0ED506CFA49798314497478CCC6AA68970B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...P..D.........." .........................................................0.......8....`.........................................0...x............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-runtime-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AFD2D84FB1CDD0C03EE2888CE4FADAFC
                                                                                                                                                                                                                                  SHA1:C2EBE9EDE75C0956F7D8431B0EA345672132A2D3
                                                                                                                                                                                                                                  SHA-256:26CE526A30CEB11AAD52B71AA4F3EA65AFE2FD6987AB517B7E86823687BE6D2C
                                                                                                                                                                                                                                  SHA-512:DEA9F4737881C4CE5591EBE9875E0981DC360DF56505D8CD9204FB15C08FC84C1B634957540A22B11C222A11F1C99A2B401DA50E55C8964C91262B186C030410
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...9..b.........." .........................................................@......./....`.........................................0...4............0..................."..............T............................................................................rdata..d...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-stdio-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2D7B04CD3E93F0C32BC999A8DD06CA31
                                                                                                                                                                                                                                  SHA1:2046473BFD777C1780E2FE51C840CA59CDCA8B8C
                                                                                                                                                                                                                                  SHA-256:B8A352807A073F0D676C862812EB768744130C1553970FE1A32EEBFF9B55AE28
                                                                                                                                                                                                                                  SHA-512:8A1C85504328F9F65A828D13F932BD6C7DB45736029F123C4E624FB77FEE8C7CEE4404224AC915C2F3B0BCEE0822BE5295B1DAAA290C269CC4008F4F31C2B862
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....v..........." ......... ...............................................@............`.........................................0...a............0...............$..."..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-string-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5C1ECCF8F088C294E4FF4ADA4E559567
                                                                                                                                                                                                                                  SHA1:BB8FC158E23445BC0DEF4BCBD4F9A622B340BB6E
                                                                                                                                                                                                                                  SHA-256:F632698BBA686C32D5DE71D42EF2080D793B52C7A2EC409C8440D0AAA315E9AC
                                                                                                                                                                                                                                  SHA-512:02CB60E4B843C4622D410ECFE48285B983A1C750242A6E894EC6556FDC35C5076437F176E7D4DADF5BBA819CE892B426F2717503C2A09B7DC1DC5FF6D3D830CC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......e.........." ........."...............................................@............`.........................................0................0...............&..("..............T............................................................................rdata..............................@..@.rsrc........0......."..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-time-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:437B1F0308340DB8C5D0D7F3C72706D7
                                                                                                                                                                                                                                  SHA1:C341A5D909855E08AC56FBFC627C61E941F7F7E7
                                                                                                                                                                                                                                  SHA-256:77F3C912052578780F06D6F63CD3FEEC925F9C20C5F0218DAC9E9C0950644614
                                                                                                                                                                                                                                  SHA-512:F622C662AA90D1F3C3A5CB316385B17DABE8AC201BBA07D8DA3B8DF8D96FD298ED39B651B4EBA1C116AD9C1C26B17A2DD32400B256DC30B5B3BCDB1D7D87FC89
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0...........`.........................................0................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\api-ms-win-crt-utility-l1-1-0.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6C82E6BDC1D0D0746803FADAA0C5FB7C
                                                                                                                                                                                                                                  SHA1:88211EB2B86D17D343F4AEE7B338882258DE7E5F
                                                                                                                                                                                                                                  SHA-256:C41EC07B44ED1CA5B4E2A32E31D7D4EA8C31F419F9D6C5795C246D9DCEE35A02
                                                                                                                                                                                                                                  SHA-512:864ECC4856F235957EA44D84A5A71ACC1E48DF1575A606DC0150A10EFBF889FD312783C1C3E9466D715BE2A09E0DD6197E48197CBD5B82CD7D9E57BE10410995
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....t..........." .........................................................0............`.........................................0...^............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\atl90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:55241DDC9A3C9DD0EBECAF78D4A767D7
                                                                                                                                                                                                                                  SHA1:F65F38DDD4F4EC5EA0EA2FE069684072CB8637A6
                                                                                                                                                                                                                                  SHA-256:9645F00C8CDBD96EC61A99443CE4EAF178CFCC164848F847B70472C377BE4FB9
                                                                                                                                                                                                                                  SHA-512:04F44715858280CA3E95605B90DBAF4BAD20712CC03243762D2372900C4FF7263BAF45E98469BC3E493B2B047FD0D04B371C5070C6DC70018AA422F4626D9EB9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.j.:...:...:....~i.8...$.K...$.3....~..9...:...>...$.....$.;...$.;...$.;...Rich:...........PE..d...'>1G.........." ........."......p.........Yy.........................................@.........................................PB......x7..(........"...............#.............................................................H....%.......................text...g........................... ..`.rdata.. ...........................@..@.data....?...P.......4..............@....pdata...............R..............@..@.rsrc....".......$...h..............@..@.reloc..t...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\aws-c-common.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D75C0C37F69BAD6E7751EE8A00C732B9
                                                                                                                                                                                                                                  SHA1:23AD0515892C6B239C4946BA14F2D1F073A5CCDF
                                                                                                                                                                                                                                  SHA-256:2E4576186E66DC1A4FAAD0DB884E3FEA9BC796CC6319FA515A69C9EED4FC9163
                                                                                                                                                                                                                                  SHA-512:DE877CD044374B2E38A138998A542F20CAFF6E7454D283B3DB561338FB2CC6C0E289BBDC7A8C445B050CEFA7ACCEE74EC0B5B83646F5737554A8678640CCABCD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./..jA.jA.jA...@.jA...D.jA...E.jA...B.jA...@.jA.j@..jA...E.jA...A.jA.....jA...C.jA.Rich.jA.........................PE..d.....>`.........." ......................................................................`..............................................R...e..d.......<.... ..X/..............p...0P..8...................xS..(...pP...............`...............................text...r........................... ..`.rdata..?........ ..................@..@.data....0.......(..................@....pdata..@5... ...6..................@..@.idata..(....`.......(..............@..@.tls....E............@..............@....00cfg...............D..............@..@.rsrc...<............F..............@..@.reloc..p............L..............@..B........................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\aws-c-event-stream.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:129CBCE34538631814B03EFE948DD98E
                                                                                                                                                                                                                                  SHA1:61B0E9DAB9C6D31F2CB1827C1361EFCFC5B2C748
                                                                                                                                                                                                                                  SHA-256:5E90538A7CD665D49A676A21A660A1695C514D004CE2584169138FB802816335
                                                                                                                                                                                                                                  SHA-512:DB9F05D20D5327CE650B0497174CB3A5FA29BF27819569A8FAE330F1DE6E1F74ADE3B1197FB283BBED9F0110FF1558A864C530EFC07444009A220A181F8C5BE4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............mE.mE.mE..lD.mE..hD.mE..iD.mE..nD.mE..lD.mEj.lD.mE.lE..mEj.iD.mEj.mD.mEj.E.mEj.oD.mERich.mE........................PE..d.....>`.........." ......................................................................`.........................................@'..........x.......<....p..........................8...........................@................................................text...r........................... ..`.rdata..@A.......B..................@..@.data...Q&...@... ...$..............@....pdata.......p.......D..............@..@.idata...............P..............@..@.00cfg...............b..............@..@.rsrc...<............d..............@..@.reloc...............j..............@..B........................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\aws-checksums.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D387390B011E1EF22E70673EA4E4CBBD
                                                                                                                                                                                                                                  SHA1:B01023D243371F83F68782D8A858EA54E9F95D47
                                                                                                                                                                                                                                  SHA-256:2FDC81210282E6240A98FE960456B7D6668B02C0235379D157CE2FE68C6928A1
                                                                                                                                                                                                                                  SHA-512:C877729370560B070B94AEC9EEC8FB8628535F3C60AD456F4E7043A422DB721810EA4EFFE03BA04E4C5705208BDAF0A1B010A431160968A864DEB103E0A09D28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........{Q..(Q..(Q..(...)R..(...)A..(...)Y..(...)S..(4..)U..(Q..(d..(...)[..(...)P..(...(P..(...)P..(RichQ..(................PE..d.....>`.........." ......................................................................`..........................................`..........P.......<.......................T....M..8...........................@M...............................................text...r........................... ..`.rdata..............................@..@.data........p.......V..............@....pdata..h............X..............@..@.idata..>............`..............@..@.00cfg...............n..............@..@.rsrc...<............p..............@..@.reloc...............v..............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\aws-cpp-sdk-core.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BBDFBF35C7915B7DCB9D1AF5957330EA
                                                                                                                                                                                                                                  SHA1:60BB7DD353AAF351853B76BEEAB13C70043CE6CA
                                                                                                                                                                                                                                  SHA-256:0874F0301AF35761203EC87BFA99B7CC1C8A6F132ADF3DADAB4B6ED81B0CEB02
                                                                                                                                                                                                                                  SHA-512:E4ADAFC5F215A2DC318DF7FB47B7C393B524E92696FD30EE6E93D7B8B0498E2BDEE553D85BB3B213413FCEBDB16DDD49536B42D1CF673C31DD04EF8B509B1FF8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c./d'.A7'.A7'.A7...75.A7u.@6#.A7u.D6>.A7u.E6/.A7u.B6$.A7..@6#.A7B.@66.A7'.@7..A7..D6..A7..A6&.A7...7&.A7..C6&.A7Rich'.A7........PE..d...hg@`.........." .....>...........|....................................................`.............................................$...$................`.........................T...................p...(...p................P..`............................text....<.......>.................. ..`.rdata..|....P.......B..............@..@.data....Z.......P..................@....pdata......`.......8..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\aws-cpp-sdk-dynamodb.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0C3EA35548698D9A7D7B79A57AC3A3DD
                                                                                                                                                                                                                                  SHA1:920F80290E08DA4D2A1FC6CBF3FAC649DE6BEE51
                                                                                                                                                                                                                                  SHA-256:FB3BCF1715EAD7930F7E6BF8A250F6B734793623B9C7B9AF3EA4B907EAF00D7C
                                                                                                                                                                                                                                  SHA-512:9538497E580AAF02C8F193ADC7AA95419C1A052B11675A24CCD62A78215931B0D40B0576BC147B16DE53D03863480F2F8594CEE2EF835F5FA88924E489F90106
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........et..............|......l......l......l......l......b......dm..............dm......dm......dm......dm......Rich....................PE..d...Uu._.........." .....(...........q........................................(...........`.........................................`... .....%.......'.......&...............'.,&.. ...T............................................@...............................text....'.......(.................. ..`.rdata..h&...@...(...,..............@..@.data....M...p%..F...T%.............@....pdata........&.......&.............@..@.rsrc.........'.......'.............@..@.reloc..,&....'..(....'.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\aws-cpp-sdk-s3.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5E7EF26A408A82E57AEC160534A7D58E
                                                                                                                                                                                                                                  SHA1:719C7A5B6B9F7C9819CFC1A0BF87C87EA74BE0B6
                                                                                                                                                                                                                                  SHA-256:FEDEDD497F3B7F9C9AD6C5F037AA4AD6A65D335CD4AF4CA8F64C445F9C77ACE2
                                                                                                                                                                                                                                  SHA-512:379BCB899CFE602745AF57764E4D98CB87D6913A616A560ACD72B91AE30F48AB162F43B58B17AB8D195407797016F9B1C5A4CE9EE5732B266105DF3D0BB3364C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Tq.CTq.CTq.C].@CPq.C...B@q.C...B\q.C...BVq.C...BPq.C1..BVq.C...BWq.CTq.Csp.C...BUq.C...BUq.C..,CUq.C...BUq.CRichTq.C................PE..d....h@`.........." .........."...............................................9...........`......................................... ....y....5......p9......@8..*............9..9..@...T...............................................@............................text.............................. ..`.rdata..............................@..@.data........`6......@6.............@....pdata...*...@8..,....8.............@..@.rsrc........p9......<9.............@..@.reloc...9....9..:...>9.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\aws-cpp-sdk-transfer.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C60FDE6F8AB53F0736C9B0344D0E2E77
                                                                                                                                                                                                                                  SHA1:FC64F0574653690D90E62436BBF11FF00C716CA0
                                                                                                                                                                                                                                  SHA-256:EAE5C6C70D3173A54425AEA784E0CE01DAF156BA55AE708A4DB357C961DFD5C6
                                                                                                                                                                                                                                  SHA-512:70ECC38321B8AAC1E18BAA76DC325BDFC47D7444786BB66EA5DE40E5FCA5FC9549FA5BBD2992B994024A70F253933395EB898B73F617A5BB29498831DEAE842C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W......................A.......A.......A.......A.......v.....................................................Rich............PE..d....i@`.........." .....................................................................`.............................................X>...................`..................|.......T........................... ................................................text.............................. ..`.rdata...@.......B..................@..@.data....1... ...,..................@....pdata.......`.......2..............@..@.rsrc................H..............@..@.reloc..|............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\fscLog.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2E194298D37850AEF5DBC4191C5B510E
                                                                                                                                                                                                                                  SHA1:C225834F9F687377896090F47C5CB96EACF7E1DF
                                                                                                                                                                                                                                  SHA-256:85CCF6172DC2FAA0AE5FDDC601F4AE005C7E20F9BC21CBE56E930A20980BBF49
                                                                                                                                                                                                                                  SHA-512:5F92F43B74069C1C61DBFBE330FA294C4C98C8F535A6408723E6E415A345870C79B29BE2CAF631B1EF068FEF88B06F5DDF4ADC1EC0E43D3B8ED1368A15E67EEF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z`.Q>...>...>....NZ.?...7yY.?...7yO.5...7yH.;...7y_.7...>...m...7yF.8...7y^.?...7y].?...Rich>...................PE..d...-..e.........." .........$......D"..............................................\F....@.........................................pG..X...`?..P....p.......`..X....B...*......0...02...............................................0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata..X....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..~............@..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\goserver.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A7D686A4C93043023C2EEEB43F49266D
                                                                                                                                                                                                                                  SHA1:90B2EDA2F38B923F0CF686786DC0C693FA35F24D
                                                                                                                                                                                                                                  SHA-256:DF69DCB341C252BC5EB184AA1156CA3B94551F8AB82CA15998516EE9A17E1DC7
                                                                                                                                                                                                                                  SHA-512:FE60C33E4837DFE1955918119795BD861E285620DACF585FA72A465C7BCC6E161336EF29D7FAEAFF67F3486C80B6689185496678D7648398336AC7CC5DD02012
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e..j.......& ...............0.........\e..............................r.....[....`... .................................................@..............`....b...*...@.. ........................... ..(....................................................text.............................`.``.data.............................@.`..rdata..............................@.`@.pdata..`..........................@.0@.xdata.............................@.0@.bss.................................`..edata..............................@.0@.idata..@...........................@.0..CRT....X.... .....................@.@..tls.........0.....................@.@..reloc.. ....@.....................@.0B/4......P....0......................@.PB/19......&...@...(..................@..B/31..........pX.......P.............@..B/45.....we8...X..f8...P.............@..B/57.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\install-EaseUSprovider.cmd (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0A3D52F1A9AE473FA34F63A329B9BA4D
                                                                                                                                                                                                                                  SHA1:CBCD0C3F0F09ADAA8B358BEE3EB39A7F3413384F
                                                                                                                                                                                                                                  SHA-256:1304F06BD1152413F1884D8D3943C71990786F2866637608B5AF4EFDF1F7E525
                                                                                                                                                                                                                                  SHA-512:3241D8988D74F1CBD741CCE1E71F5FFA77DFE48D8EE75F3A61A16FD96E6F5F74AC5216C7B7D972BDBCD968B15EF632556D30F59071BEC6C3D59D1019422531B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:@rem @echo off..@setlocal......@rem the DLLs to be installed must be either in the current directory as this script or..@rem in the SDK BIN directory...@set FOUND_FILES=0..@set CMD_DIR=%~dp0......:installfromCurrentDir..@set DLL_DIR=%CMD_DIR%..@set VBS_DIR=%CMD_DIR%..@call :checkfiles..@if %FOUND_FILES% EQU 0 (goto :installfromSDKDirs) else (goto :goodproc)......:installfromSDKDirs..@set DLL_DIR=%CMD_DIR%\..\..\..\..\BIN..@set VBS_DIR=%CMD_DIR%..@call :checkfiles..@if %FOUND_FILES% EQU 0 (goto :missingfiles) else (goto :goodproc)........:goodproc....rem Remove existing installation..call "%CMD_DIR%\uninstall-easeusprovider.cmd"....@rem Get the complete %DLL_DIR% and %VBS_DIR%..@pushd %DLL_DIR%..@set DLL_DIR=%CD%..@popd..@pushd %VBS_DIR%..@set VBS_DIR=%CD%..@popd....rem Register VSS hardware provider..cscript "%VBS_DIR%\register_app.vbs" -register "VssEaseusProvider" "%DLL_DIR%\VssEaseusProvider.dll" "VSS Easeus Provider"....set EVENT_LOG=HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-03CUP.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1567
                                                                                                                                                                                                                                  Entropy (8bit):5.186234757000513
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7334C2AC5C9A813AE7411641E51EF8C3
                                                                                                                                                                                                                                  SHA1:FBB3568355CEEB2F3FDA2A9D2FA2C80CA3C70508
                                                                                                                                                                                                                                  SHA-256:7D803D9872CB3DE1337C67041CDB9A1056C5C6C28F8A9EEBA631EB0572AB43F0
                                                                                                                                                                                                                                  SHA-512:6536F6C0912A4D03A6D89466252F936FC895D5E0C239E9B85315619D061F88816CF7652B444B6063A6023A6A327EFFABBA85D472D4CD86B67F1FFAC324BB2412
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:@rem @echo off..@setlocal......@rem the DLLs to be uninstalled must be either in the current directory as this script or..@rem in the SDK BIN directory...@set FOUND_FILES=0..@set CMD_DIR=%~dp0......:uninstallfromCurrentDir..@set DLL_DIR=%CMD_DIR%..@set VBS_DIR=%CMD_DIR%..@call :checkfiles..@if %FOUND_FILES% EQU 0 (goto :uninstallfromSDKDirs) else (goto :startuninstall)......:uninstallfromSDKDirs..@set DLL_DIR=%CMD_DIR%\..\..\..\..\BIN..@set VBS_DIR=%CMD_DIR%..@call :checkfiles..@if %FOUND_FILES% EQU 0 (goto :missingfiles) else (goto :startuninstall)........:startuninstall....net stop vds /Y..net stop vss /Y..net stop swprv....reg.exe delete HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VssEaseusProvider /f....cscript "%VBS_DIR%\register_app.vbs" -unregister "VssEaseusProvider"..regsvr32 /s /u "%DLL_DIR%\VssEaseusProvider.dll"....echo...goto :EOF......:checkfiles ....@if not exist "%DLL_DIR%\VssEaseusProvider.dll" goto :EOF..@if not exist "%DLL_DIR%\VssEaseusProviderPS.dll

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-0BKIV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):851456
                                                                                                                                                                                                                                  Entropy (8bit):6.355228323730977
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F7CD95A47F9C2291DB184C6C4AD7E120
                                                                                                                                                                                                                                  SHA1:67CBA6F7FE2DD19B2640A7217CD968177BF100AA
                                                                                                                                                                                                                                  SHA-256:10859F06F41144FA32CF5DA223511F85FE349B1D76471EF65F0395DAC606EF63
                                                                                                                                                                                                                                  SHA-512:C96E17345D5B893A56D1004227E37A6906AE6DA53E7CB33679E00BB807C28F4016DD6F91A2C038FE843FEA56D08A55CF54EC3EA54B3A77F6EA0A08979AB7C965
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.A.#...#...#......#...qy..#...#..>#...l|..#...q...#...qn..#...qi..#...qx..#...q~..#...q{..#..Rich.#..........PE..d....>1G.........." .....D....................Rx.............................0......y.....@..........................................>..j....0..<................p.......$... .......f...............................................`..8............................text....C.......D.................. ..`.rdata..j....`.......H..............@..@.data....7...P...$...0..............@....pdata...p.......r...T..............@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-10P6Q.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12304
                                                                                                                                                                                                                                  Entropy (8bit):6.680660424516745
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:915F1C029D8B51CE579FE6F5330A77CA
                                                                                                                                                                                                                                  SHA1:1629E4611E444FCC2514C522E6AC626860F370A5
                                                                                                                                                                                                                                  SHA-256:8065D56D1442DE48A43B98FEC8A9788EE144D997604180629CE303EE9BA53D8E
                                                                                                                                                                                                                                  SHA-512:E0D6900B9D8BD496D41C8CC538054E39E20CACA88B8C54B52A2EBC7F01B104DB25D9FE2D5FC2B269040CF75AD1C35759D7930BE874F034191D03E0DD458E3235
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0.......c....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-127NI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11784
                                                                                                                                                                                                                                  Entropy (8bit):6.626369956132994
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:04EDE6B39122AF646BAFC812BEB843C7
                                                                                                                                                                                                                                  SHA1:8E7F49B06BC6B5D55007102E8BB4558900E96B57
                                                                                                                                                                                                                                  SHA-256:1C8450668F49FEE4DE8559F312F7CAAF7DA26216B92D5A4C26493D8188DAD9EB
                                                                                                                                                                                                                                  SHA-512:FD348E7E90310EA1E14686EA3A3BA3B3584E2EC1BC659F40F70F87DD729530868C44FAD40D941A5724A4FCCAE0A7F1AD3E45F5CE9914E4DA055E9BB9A8B2AD10
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0............`.........................................`...<............ ..................."..............T............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-151GI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):365064
                                                                                                                                                                                                                                  Entropy (8bit):6.36358359944149
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DE879E228576075315B75AD877C0F592
                                                                                                                                                                                                                                  SHA1:314BA7172433437F223A7940B8DB2B276C3DB4C9
                                                                                                                                                                                                                                  SHA-256:E839A1C297BA6F7A0653F54357B01AE4F6F7F8C5D329C6F477AA936BBA586A50
                                                                                                                                                                                                                                  SHA-512:CD4E6CB50283B2A49351FA61A7395DD075063D671E1E9DC0A0322D298226F67C3523426603046D75DF9CC9CF2334CCD88C4DDFB7452B875963C9DECF43ACA35C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.s/...|...|...|..|...|..|...|..|...|..|...|..|...|...|...|..|/..|..|...|..|...|..|...|Rich...|........................PE..d...O..e.........." ................t...............................................U.....@.............................................f...............D....@...8...h...*...........................................................................................text...[........................... ..`.rdata...d.......f..................@..@.data...P$..........................@....pdata...8...@...:..................@..@.rsrc...D............L..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1KK0P.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):182280
                                                                                                                                                                                                                                  Entropy (8bit):5.923615369743057
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:64768751F94D7D3A7D77D07CE9A50A94
                                                                                                                                                                                                                                  SHA1:162D1812EF1AC13DCAA01FF6FC83EC1AE7F7E92C
                                                                                                                                                                                                                                  SHA-256:F0211885DEFE18A010B274A3AFFAFF9013852D94D5BED7E5226633FB8289ADF3
                                                                                                                                                                                                                                  SHA-512:7D34BCE65EEF58C27D4FBE597A9E2B924FA457A661F56F8BA8D0FF8F20460155F749F0DE02E76CDD0FCB71FFE051F4AEAED3FC7A17F8108079303437A0BE6351
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%q.0a..ca..ca..c._$c`..chh'cc..chh1cj..chh!cl..ca..c...chh8cc..chh6cm..chh c`..c.B&c`..chh#c`..cRicha..c................PE..d......e.........." ................0...............................................74....@.........................................0...g...\p...........................*..............................................................@............................text...U........................... ..`.rdata..............................@..@.data...`............x..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1N5OG.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11576
                                                                                                                                                                                                                                  Entropy (8bit):6.663280789944832
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3894F6DE1588840F9282246D527CB077
                                                                                                                                                                                                                                  SHA1:BED0EDAE7EC79A72077913A3620337CC5E854067
                                                                                                                                                                                                                                  SHA-256:6199098A9054AA37578BA1547028424B1026AE604D3F4F1F745FB88B60B1AC27
                                                                                                                                                                                                                                  SHA-512:AF4567489CDEC971656E1BB4BCE0CF6AA71CA7053B47ACBCD78DB82584525C846C0456D1CFEA101D61D5F7DD5A13FA26DDF4E7B81EC8A917ADD8DEA07CF4436F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....:.[.........." .........................................................0.......w....`.........................................`................ ..................8!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-1OMHH.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):937480
                                                                                                                                                                                                                                  Entropy (8bit):6.443809454356348
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6AF20E9147018998A9477CC7DD7CBAAD
                                                                                                                                                                                                                                  SHA1:77BE155985EA2F1AA2E428B8B40CE91E2F3D5A1E
                                                                                                                                                                                                                                  SHA-256:42C87029F0E917D4917BF2C2AA89BB45EB57FB5240B2A8107EA8C24B709CE973
                                                                                                                                                                                                                                  SHA-512:8D3D12AF357599934D9BDCC558E8F3910530E0901FA1C04C4CD3BAEBD9ED64DE8AB831A2DB25F99E2FB9429E86F5057AE5A5A7D2D826D2D538F10152C89CA5DE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.F.7.(.7.(.7.(....5.(.>.5.(.>.&.(.7.)...(.>.".(.>.<.(.>.~.(.>.6.(.>.6.(.Rich7.(.................PE..d...7..e.........." ................<........................................p......f.....@.........................................._.......H.......@...........w...$...*...P..@....D...............................................@..x............................text....,.......................... ..`.rdata..Q8...@...:...2..............@..@.data....0.......*...l..............@....pdata...w.......x..................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2413K.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):153096
                                                                                                                                                                                                                                  Entropy (8bit):6.060731445886606
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AF2BDB2265245E99189C4ABA60AC71ED
                                                                                                                                                                                                                                  SHA1:3FD925C2D104D9C0B9A0E7656C8900065BC7DF16
                                                                                                                                                                                                                                  SHA-256:60F383C9A598F35CBCAD8A0C997B42CEDD53A79D7F1AD00C98C441C6CC4E3D64
                                                                                                                                                                                                                                  SHA-512:77AA728FC01BCEDAF642477912151DA27AC7D662CA547104C6BF9A6164B08E402387036F9BE3669F0AB11A3B14EF1D1DA6186D7BA1B2CA2E74A5B199510B5103
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........XE..6...6...6......6...2...6...5...6.e.7...6...3...6...7...6...7...6...7.).6.h.?...6.h.6...6.h.....6.h.4...6.Rich..6.................PE..d...v>.d.........." ................................................................l$....`.........................................@...X............`.......P.......,...*...p..l.......p...........................p................................................text............................... ..`.rdata.............................@..@.data........0......................@....pdata.......P......................@..@.rsrc........`.......&..............@..@.reloc..l....p.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2CG5H.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):14376
                                                                                                                                                                                                                                  Entropy (8bit):6.6851002355812215
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:39475799BFAEE65894F94A0F15D0D1FB
                                                                                                                                                                                                                                  SHA1:F7A4E3DC3FB5133C53BE4F1B7F1956D85F6F392E
                                                                                                                                                                                                                                  SHA-256:2D9F380091506EB22F0E92C68F6D8641C06FA92F733494FEE9836FD748A294D5
                                                                                                                                                                                                                                  SHA-512:7156D60EE067F99D21C9D88883C90E8C83D75729807CDD77A37D74D6B15A8224D93189C1283C8756EF18A965BB8A11AD2DA84BB6FE8ACBFFB83503FE6B5355A1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0.......H....`.........................................`................ ..................("..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-2TEB0.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):395784
                                                                                                                                                                                                                                  Entropy (8bit):6.363326871633291
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:67545DCF08D3C5B034DB48E28F14D289
                                                                                                                                                                                                                                  SHA1:2912E038DA79D4FAA09CE6D54E780D86ACEA2140
                                                                                                                                                                                                                                  SHA-256:320EA26F37B68AB95E7E43932A3E29222D915BD1A26CE045700D6878DA8F3949
                                                                                                                                                                                                                                  SHA-512:CFF9E03D80670EE6DB9F89082BE38A931E87931FFBAB2CB22058CCD2FA30D1BA23EE20BD8977847496003E209A4738A68898BD2D570D43A7E6114D1EB6867177
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Zq..............._......h......h.......h.......h.......~......h.......h......h.....Rich....................PE..d...5..e.........." ......................................................... ............@.........................................p........g..x................C.......*.......... ................................................................................text............................... ..`.rdata...t.......v..................@..@.data...p............z..............@....pdata...C.......D..................@..@.rsrc...............................@..@.reloc..|...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-3838S.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12808
                                                                                                                                                                                                                                  Entropy (8bit):6.617957123156255
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:09D0BFE93E1F295C533DC360A3490167
                                                                                                                                                                                                                                  SHA1:5532422719BB183B92923AA1CB03D05F8CFDE61C
                                                                                                                                                                                                                                  SHA-256:9AAE2D8C26F613E368EAD960A101B05BCDA63B0109BD24A6AAAB8C45EF1AAB93
                                                                                                                                                                                                                                  SHA-512:60CE0B8ED8F1D119897FB0B8D0AF1D615B88E672E7DB6FB8B02E2DC50D93EE2273744A4BDA0C06550250595AE570C0ED506CFA49798314497478CCC6AA68970B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...P..D.........." .........................................................0.......8....`.........................................0...x............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-3SI6I.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):13840
                                                                                                                                                                                                                                  Entropy (8bit):6.6621084025322785
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:25586E8F953667BBBB2A7F2E25949808
                                                                                                                                                                                                                                  SHA1:9597DC051C9EF3C234D03C5856402964E8E36110
                                                                                                                                                                                                                                  SHA-256:C6FF48E6EDB727FCA3971DB306E617462A4D692CBBBE2693D447F072720ECEE6
                                                                                                                                                                                                                                  SHA-512:AF607633CBDEBAD127AD804B4C54957E74102D0F4FDE2F3229E163FDA7EFD9BFB923E812D25CDAC13332FD7F6584830BE8CFAAB4C84CCD78E5642A014E5A8B93
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r..x.........." .........................................................0...........`.........................................0................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-41UF1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):24072
                                                                                                                                                                                                                                  Entropy (8bit):6.63979446719112
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CF771771DB7108010DFE075D429BCB99
                                                                                                                                                                                                                                  SHA1:7E59AD168B6D34BEF19E79652EE0586ADF126474
                                                                                                                                                                                                                                  SHA-256:0F20CAFFDAEC6C6C2E0C0D971E48E0128FF1CAF103DCC5E36F4A939381E37ED7
                                                                                                                                                                                                                                  SHA-512:75F9ED60851B7831F1623EAD0EC45D9C3FBF2233078768AF701272D66D3AF6969DF895C732556D6330FC067A5337DFAD3DE000294E9D0F66073C7FBC1A2EC12D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................y.....o.....h................f.....}....Rich...................PE..d......e..........".................(..........@.....................................u....@..................................................7..d....p.......`.......4...*...... ....2...............................................0..`............................text............................... ..`.rdata..&....0......................@..@.data........P.......*..............@....pdata.......`.......,..............@..@.rsrc........p......................@..@.reloc..J............2..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-424HV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):216576
                                                                                                                                                                                                                                  Entropy (8bit):6.030175098893482
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C60FDE6F8AB53F0736C9B0344D0E2E77
                                                                                                                                                                                                                                  SHA1:FC64F0574653690D90E62436BBF11FF00C716CA0
                                                                                                                                                                                                                                  SHA-256:EAE5C6C70D3173A54425AEA784E0CE01DAF156BA55AE708A4DB357C961DFD5C6
                                                                                                                                                                                                                                  SHA-512:70ECC38321B8AAC1E18BAA76DC325BDFC47D7444786BB66EA5DE40E5FCA5FC9549FA5BBD2992B994024A70F253933395EB898B73F617A5BB29498831DEAE842C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W......................A.......A.......A.......A.......v.....................................................Rich............PE..d....i@`.........." .....................................................................`.............................................X>...................`..................|.......T........................... ................................................text.............................. ..`.rdata...@.......B..................@..@.data....1... ...,..................@....pdata.......`.......2..............@..@.rsrc................H..............@..@.reloc..|............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-42D15.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):191825
                                                                                                                                                                                                                                  Entropy (8bit):5.857363931276206
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F8AFE5B39BD512D26870A7A7D21B36AE
                                                                                                                                                                                                                                  SHA1:B27E01F2C8AA57C06515236B28DB8E094620AB84
                                                                                                                                                                                                                                  SHA-256:A2AC91DB618F4B7C7B25DA854A3C06663FAFE5F13EB3F57261E67D1D4A02F1AF
                                                                                                                                                                                                                                  SHA-512:BB6DF3BC7A7E840AF2F73DD06572EF1F4A0DEA9AF01AA1485DE577B87222AE2FA3660871A612581BA38FB52B4F4488794B7082E27326F238D4D1535EEC73B658
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...3.kL.n........& .........f.................b.............................P................ ......................................... .......\...............................d....................................................................................text............................... .P`.data...............................@.`..rdata..pF... ...H..................@.`@.bss....0....p........................`..edata.. ............H..............@.0@.idata..\............P..............@.0..CRT....X............Z..............@.@..tls....H............\..............@.`..rsrc................^..............@.0..reloc..d............b..............@.0B/4...................d.................B/19.....L............h.................B/35.....I............p.................B/51.....X............~.................B/63....................................B/77.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-48BPV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):113160
                                                                                                                                                                                                                                  Entropy (8bit):6.157240886815381
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1469E7DC93D1BEECF0D3204D279F6632
                                                                                                                                                                                                                                  SHA1:B60B05031F9BBA1603D67B8BD72BA02151E94594
                                                                                                                                                                                                                                  SHA-256:7683A94CD42F5AEC59823EEA36243AB832EA169C8491ECF3FBA5E0E6754B303C
                                                                                                                                                                                                                                  SHA-512:14569D70BBF44C23B139DA316A288F998122965E23B972CEB47F1A9A2361EF328AAF081C3F5A98B463AAB1A3CE91E6098C0613FA9D49F059DF0CE4A6D45D0696
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|.O..s...s...s..e....s...r...s..e....s..e....s..e....s..e....s..e....s.Rich..s.........PE..d......e.........." .................V..............................................W:...............................................{.......q..P........................*......P....................................................................................text............................... ..`.rdata...k.......l..................@..@.data....6...........b..............@....pdata...............x..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4CCFO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12816
                                                                                                                                                                                                                                  Entropy (8bit):6.613398783135292
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C0C1F885BF86C487ECF9608CFAEA3447
                                                                                                                                                                                                                                  SHA1:7AE85086713423333B1A4DC45DC79262A7B714BE
                                                                                                                                                                                                                                  SHA-256:E1E33D9F38F5E477C9763A7367B31321AD8E8ACD572CA623EC84421D17B511E6
                                                                                                                                                                                                                                  SHA-512:367F5DBFA06B534EA12FA19FE0911E1FA209668A40306632823B71F154B6DF28A7AA09805BF88BE7D7076E817384F450209D47830476B7A495C7F701CC3F61EA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0............`.........................................`...H............ ..................."..............T............................................................................rdata..x...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4KBC7.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):14352
                                                                                                                                                                                                                                  Entropy (8bit):6.55464433278048
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:437B1F0308340DB8C5D0D7F3C72706D7
                                                                                                                                                                                                                                  SHA1:C341A5D909855E08AC56FBFC627C61E941F7F7E7
                                                                                                                                                                                                                                  SHA-256:77F3C912052578780F06D6F63CD3FEEC925F9C20C5F0218DAC9E9C0950644614
                                                                                                                                                                                                                                  SHA-512:F622C662AA90D1F3C3A5CB316385B17DABE8AC201BBA07D8DA3B8DF8D96FD298ED39B651B4EBA1C116AD9C1C26B17A2DD32400B256DC30B5B3BCDB1D7D87FC89
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0...........`.........................................0................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-4U7OG.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):316936
                                                                                                                                                                                                                                  Entropy (8bit):5.769597954038245
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2FE1EC30432F2B5F71BB9BBFA8C513BF
                                                                                                                                                                                                                                  SHA1:8FAD0814E15638DE968ADF2451D918202043AF5A
                                                                                                                                                                                                                                  SHA-256:4F397F47C456482A3CE871C0BD3F7929BF69554CBE09DE6AB6483F64A8F864E8
                                                                                                                                                                                                                                  SHA-512:7FA8A39170464AAF92A0913BB67BC9754E81977F594FDBAFD89D62677D8C817E749DB9BD789331A4A638451E24F874E6B4E9E93CEAD0D7F788402E670E46089A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r}.M...M...M....\..L...Dk..O...Dk..F...Dk..D...Dk..@...M.......Dk..^...Dk..L...Dk..L...RichM...........................PE..d......e.........." ......................................................................@......................................... p.......Q...................4.......*......@....................................................................................text...6........................... ..`.rdata...p.......r..................@..@.data...0............`..............@....pdata...4.......6...j..............@..@.rsrc...............................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-52N81.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):619568
                                                                                                                                                                                                                                  Entropy (8bit):6.372475942292129
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5B87055D003DE54C70F79825752D2325
                                                                                                                                                                                                                                  SHA1:B81066EB260DF44E173C8C89E6C660FF9B4B5407
                                                                                                                                                                                                                                  SHA-256:E0ADD11321940F454122E9505E9574957168ABB885176B86D63A092928BC9453
                                                                                                                                                                                                                                  SHA-512:53BB52C3440D9E0CA0F6E019874584B64A657C79BD17B284B9903EAD51DE89C05F958DFF7E676AD237CA87F2C5FD781024E374BD0202169338E1B47B726649EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..0}.0}.0}e..}.0}..}.0}.1}..0}e.1|.0}e.3|.0}e.4|..0}e.5|..0}e.0|.0}e..}.0}e.2|.0}Rich.0}........PE..d......\.........." .........H......`...............................................>.....`A........................................`...h............p....... ...?...6..0>..........`...8...........................P................ ..........@....................text............................... ..`.rdata...... ......................@..@.data....;..........................@....pdata...?... ...@..................@..@.didat..h....`.......$..............@....rsrc........p.......&..............@..@.reloc...............*..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-5NJS0.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):96256
                                                                                                                                                                                                                                  Entropy (8bit):5.7300285922047145
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D387390B011E1EF22E70673EA4E4CBBD
                                                                                                                                                                                                                                  SHA1:B01023D243371F83F68782D8A858EA54E9F95D47
                                                                                                                                                                                                                                  SHA-256:2FDC81210282E6240A98FE960456B7D6668B02C0235379D157CE2FE68C6928A1
                                                                                                                                                                                                                                  SHA-512:C877729370560B070B94AEC9EEC8FB8628535F3C60AD456F4E7043A422DB721810EA4EFFE03BA04E4C5705208BDAF0A1B010A431160968A864DEB103E0A09D28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........{Q..(Q..(Q..(...)R..(...)A..(...)Y..(...)S..(4..)U..(Q..(d..(...)[..(...)P..(...(P..(...)P..(RichQ..(................PE..d.....>`.........." ......................................................................`..........................................`..........P.......<.......................T....M..8...........................@M...............................................text...r........................... ..`.rdata..............................@..@.data........p.......V..............@....pdata..h............X..............@..@.idata..>............`..............@..@.00cfg...............n..............@..@.rsrc...<............p..............@..@.reloc...............v..............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-5V464.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):104456
                                                                                                                                                                                                                                  Entropy (8bit):5.804592699118242
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:658B346BA09199944A42321E8C72A706
                                                                                                                                                                                                                                  SHA1:00E485115A91638E2E66DD948943DEE97CE1A9D7
                                                                                                                                                                                                                                  SHA-256:E357E0499B69C7982BB5976CBEA25C49A5A53C260F504ACE91291C5613AF8669
                                                                                                                                                                                                                                  SHA-512:ED4D4D27FC002CCA1165027034C35DAFB55081002D15741D846B16FE1DB963840A598F62D8C53920E3159A76A0A5B6EB141EBFC7EC4CCA0789E03CE30AAA2835
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.\M.\M.\.'\L.\D.$\L.\D.2\_.\D.5\E.\D."\D.\M.\(.\D.;\J.\D. \L.\RichM.\........PE..d......e.........."..........n......`..........@....................................-.....@..................................................P..d............p..H....n...*..........p................................................... ............................text............................... ..`.rdata...L.......N..................@..@.data........`.......N..............@....pdata..H....p.......T..............@..@.rsrc................h..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-65H2S.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):751104
                                                                                                                                                                                                                                  Entropy (8bit):5.578685207947649
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CF78EE8A280D6FFF992AE4CCDE9F7AC2
                                                                                                                                                                                                                                  SHA1:4A87C74E6BB108F46959242617FC34249C2FDEA5
                                                                                                                                                                                                                                  SHA-256:4E10330BF050DD4AD19DB1AF518967EC46722C633F5A0A2063AE7D04E95CFF21
                                                                                                                                                                                                                                  SHA-512:72679BA2D2677ED58BA34C41469F447DA48C553E6B9E13469C6B703C6EFBB0DBD606677F48843C91B70DFE7C92BC47F9771C844E1C8386C028E9944CA8CF33B6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E...E...E...bp..G...L...G...L...G...L...@...E...^...L...~...L...D...[...D...L...D...RichE...........................PE..d.....^e.........." ................................................................b....................................................Q......P....p..D.......PR..............4...P................................................%..8............................text...5........................... ..`.rdata...y.......z..................@..@.data...QL...`...H...N..............@....pdata...[.......\..................@..@.idata..*\.......^..................@....rsrc...D....p.......P..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6A81G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):17936
                                                                                                                                                                                                                                  Entropy (8bit):6.404137552120944
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2D7B04CD3E93F0C32BC999A8DD06CA31
                                                                                                                                                                                                                                  SHA1:2046473BFD777C1780E2FE51C840CA59CDCA8B8C
                                                                                                                                                                                                                                  SHA-256:B8A352807A073F0D676C862812EB768744130C1553970FE1A32EEBFF9B55AE28
                                                                                                                                                                                                                                  SHA-512:8A1C85504328F9F65A828D13F932BD6C7DB45736029F123C4E624FB77FEE8C7CEE4404224AC915C2F3B0BCEE0822BE5295B1DAAA290C269CC4008F4F31C2B862
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....v..........." ......... ...............................................@............`.........................................0...a............0...............$..."..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6ENEU.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):21008
                                                                                                                                                                                                                                  Entropy (8bit):6.217693406276633
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B3937AE7171B6B3D02166BFA9CD6CA9E
                                                                                                                                                                                                                                  SHA1:949C7DFFEB2A0957F741AF5CADE887D8FA0B89EB
                                                                                                                                                                                                                                  SHA-256:84B21FD1737B7D8953E22BD4DF29CD933E3FC0A07D134598BF062F7ECF984AEB
                                                                                                                                                                                                                                  SHA-512:00EFD098585546C25B4F8489673B8707E411FEB1CA0936F4FFB9FFBFDF160218EEF8E6870EA85CDB659C2FC243A473C28C7BD9B9D708163181BC9EB85EC416BC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...IV............" .........,...............................................P.......d....`.........................................0....%...........@...............0..."..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6FK0U.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):163336
                                                                                                                                                                                                                                  Entropy (8bit):5.843588754845058
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DB74FD58194A8435ECA85817178727FD
                                                                                                                                                                                                                                  SHA1:58D829DA78ABC6DB82B6916968B90C5878915D80
                                                                                                                                                                                                                                  SHA-256:FE87D34178AC4C6A726CDE5D9361859BE668A884A0E5647BECF8918EAEBAD8F4
                                                                                                                                                                                                                                  SHA-512:A4848156C86DE192883A53C644A4F3D91F103C6212641635F5D80DAEAB33FFA38E4FBCE5F493C579E856133B1FA4EAA6388304AB71E763AC42937FA37ED896A6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.............'...........................................^...........................Rich....................PE..d......e.........." ................................................................*.....@.........................................0>..........................4....T...*......h.......................................................P............................text............................... ..`.rdata.............................@..@.data...(>...@.......&..............@....pdata..4...........................@..@.rsrc................L..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6HA19.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11792
                                                                                                                                                                                                                                  Entropy (8bit):6.616228745530818
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F44C562F058C83CF98CB51A65410B5B9
                                                                                                                                                                                                                                  SHA1:CB633F131891380B8B5FFA87B332337FB24C5EBC
                                                                                                                                                                                                                                  SHA-256:89C3B43B4BF37D04253A8D565F055A29BBC0D84A473646D4F0787C96DE90FAE8
                                                                                                                                                                                                                                  SHA-512:6D52E929DA91A95E7CDE24EBF4E2326356442E3F10296DF8FB3F975C6EFAE3201605F95B413F827450D16BC14105CA2E6B1D9ECB45B944BCF72E1689039EBFB5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....Ab.........." .........................................................0.......Q....`.........................................`................ ..................."..............T............................................................................rdata..4...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-6Q2L9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):245248
                                                                                                                                                                                                                                  Entropy (8bit):6.010429194729516
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AA6698EC95F726F6931F701047426BC3
                                                                                                                                                                                                                                  SHA1:00CD963EC834CC13D94B67A4F1872716486B010A
                                                                                                                                                                                                                                  SHA-256:450DBCF05DB9E23C4CF96707D729A61FCDE8B80690F7E9A3685652EFF30161A3
                                                                                                                                                                                                                                  SHA-512:74A2EF668C8A45BE3352114332AB46A4281995602EFB84505A686FDE1AB7B0D653E83365AE9FBF6179D4CC358D92C37CB0A5BCDBD7442AE794A481A53F596AA1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k}../../../..1Na.,..Sd....1Ng....K...-.....+../....1Nq.$..1Nv.t..1N`....1Nf....1Nc....Rich/..........PE..d....>1G.........." ..........................Hx..........................................@.....................................................d...............D....................0............................................... ..@............0..H............text............................... ..`.nep................................ ..`.rdata....... ......................@..@.data...............................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..B...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-776R2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12304
                                                                                                                                                                                                                                  Entropy (8bit):6.611280078045226
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8786314584FDFE3FEDF85EAA7EB5C008
                                                                                                                                                                                                                                  SHA1:918CE4C53463092C1B90A62BEF36C5B1BD6D56C4
                                                                                                                                                                                                                                  SHA-256:95ED852901E3F0384334A8363F97FAFA0004B97A9D7B3E0175100B9ACD1D4166
                                                                                                                                                                                                                                  SHA-512:43E4C44DF4B1231D3C1A2E6D9678E7CC0152D497ADF36E0C464B92530D2358FA303B90EFCC5E35ED9D789ED3D1ABB71BDAA1EC68C2B68FF41DA82613ACFF1620
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...._............" .........................................................0............`.........................................`................ ..................."..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-7NJGF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):120328
                                                                                                                                                                                                                                  Entropy (8bit):5.837023180890616
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E7878466CD2C28A72C0B9813D9726455
                                                                                                                                                                                                                                  SHA1:CD01423ED460736675311E7B9105239119ABFCC1
                                                                                                                                                                                                                                  SHA-256:30EDB557487D9DE2101C294055797B8825F777C6A4ED4A6895E468A274366C37
                                                                                                                                                                                                                                  SHA-512:BC4592DE10D0C4BD1B7EB1E32B93D50FEA83599188AC1238AC8892D07BC633E1EA096D854DE35F8BA511C234E74DDB9A82155A87C7DBF3595901103C47CF2E5C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H!<..@R..@R..@R.....@R..8..@R..8..@R..8..@R..8...@R..@S.l@R..8..@R..8...@R..8..@R.Rich.@R.........PE..d...q..e.........." ..... ..........................................................kZ....@.....................................................d........................*..........P3...............................................0.. ............................text...h........ .................. ..`.rdata...f...0...h...$..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-827NN.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):73472
                                                                                                                                                                                                                                  Entropy (8bit):6.034407135883242
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6AD3BCA9AE208462E741F2216D1B3324
                                                                                                                                                                                                                                  SHA1:222DF609B3E741563900C228C6DBC914C820C357
                                                                                                                                                                                                                                  SHA-256:CD7F006C9CBEAB45425626B9C0C3929829466B0B13BEA3C0DBB3546B93BCE7A3
                                                                                                                                                                                                                                  SHA-512:55D670BE80DE3B1092003A1AC0E99C5F9C0B6027A25CC52CCF18F8D9F324F06C38EA2BC22B2B867F9585691E547662BBD6F09C60EFC8E38C7659E409014EE308
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........j.9.9.9N.$9.9..'9.9..19...9..69...9..!9...9.9V..9..89...9.. 9.9..#9.9Rich.9................PE..d...@xUe.........." .........r......\~.......................................P............@.........................................P...........x....0....... ..$........!...@..........................................................x............................text............................... ..`.rdata...Y.......Z..................@..@.data...8...........................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-88M7F.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):252936
                                                                                                                                                                                                                                  Entropy (8bit):5.766834910052561
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6E3F47C4E51ADB4DD6A2F44793F61C18
                                                                                                                                                                                                                                  SHA1:92B77D142CB0693C0E5BBCA3CF58E732FEADCC87
                                                                                                                                                                                                                                  SHA-256:7339F719D514E6F9580891C26D370830ACBE2EB3AF6FEE8E8F40A34E53EE0CBB
                                                                                                                                                                                                                                  SHA-512:9FE0F9FD6ABF1DD93F022449501208CA4A94D856F40CE2D6E807F1EBFB7572A4C3B432D8E2B32CD982C5E7F9EB9454FCA78B3D7B07E3FF772A83D050DCA23445
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............r...r...r.7...r.....r.....r.......r.....r...s.;.r.......r.....r.....r.Rich..r.................PE..d...c..e.........." .....v...8.......K....................................................@..................................................c..x................,.......*...........................................................................................text....u.......v.................. ..`.rdata..s............z..............@..@.data................t..............@....pdata...,...........z..............@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8FNSC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):389640
                                                                                                                                                                                                                                  Entropy (8bit):5.824469005013778
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1490CB852CD79C9962135E90D499D3A1
                                                                                                                                                                                                                                  SHA1:47F5295AA4D5E0D78DA4A194EED9130DF91D1B09
                                                                                                                                                                                                                                  SHA-256:E5FE6C5337207A63C6F629CEC21D186C489D16DF7206070099B00F3A05EBC659
                                                                                                                                                                                                                                  SHA-512:60501B8A2511B32615081BA23F92CF9A8299AE1D461374024242CCA1B35B7DEB5BF7BEDAADCED835173461FE6FC351D585BE3A05D266C88B6642662EA8959BA5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......OS.#.2.p.2.p.2.p.}Zp.2.p.JYp.2.p.JOp.2.p.JHp.2.p.J_p.2.p.2.pq2.p.JFp.2.p.J^p.2.p.J]p.2.pRich.2.p........PE..d......e.........." ......................................................... ............@......................................... .......\{..................|5.......*..........P................................................................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..|5.......6..................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8GORL.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):363528
                                                                                                                                                                                                                                  Entropy (8bit):5.968363841308356
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6EC9D1FB8D920837E9BE385E083E8B9F
                                                                                                                                                                                                                                  SHA1:FC80482EF110529481E437329BB6C3FAC271DBD5
                                                                                                                                                                                                                                  SHA-256:4EFC277B06A213F8BDBE0827F2E702D04562294DE4306A566CE9B893C3EABA97
                                                                                                                                                                                                                                  SHA-512:CBC91CA6CCF94F5190178AF0716B6CD3F3F9B5CDED2EABB8D5369BFD83A00BEEAF1BE65CB6857C572C3357961801EE69BE49C3535EDBB1AED53517799072581A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.2b!.\1!.\1!.\1...1".\1(..1#.\1(..1).\1(..1-.\1(..1*.\1!.]1.\1(..1:.\1(..1 .\1(..1 .\1Rich!.\1........................PE..d......e.........." .....$...:............................................................@.............................................w.......x............0...E...b...*...........F...............................................@...............................text...C#.......$.................. ..`.rdata..W....@.......(..............@..@.data...@...........................@....pdata...E...0...F..................@..@.rsrc................P..............@..@.reloc...............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-8JNB5.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):158216
                                                                                                                                                                                                                                  Entropy (8bit):6.113980161914509
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4E6881347C3867CE6FA05FF302BBB798
                                                                                                                                                                                                                                  SHA1:E8DB268770CCB5E4F0353F2F812088E6DAFC9C81
                                                                                                                                                                                                                                  SHA-256:75B02FACFDC5F24A9C58B8B2CA89B5B252DA188F3E4CA8D0961D64805CFDCF7C
                                                                                                                                                                                                                                  SHA-512:71386FE3904B24EAA43B33423D27D6D958157B9F604B10016E70710B6895FA56F5F814415B8029FBCCCA2AAFBB6C6ED5A63E6B7216B70727F0AA21C3F28B47E8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i.46-.Ze-.Ze-.Ze...e,.Ze$..e/.Ze$..e&.Ze$..e$.Ze$..e$.Ze-.[e~.Ze$..e%.Ze$..e,.Ze3..e,.Ze$..e,.ZeRich-.Ze........PE..d...9..e.........." .................o....................................................@..........................................!..f.......d....`.......@.......@...*...p......................................................................................text.............................. ..`.rdata..............................@..@.data........0......................@....pdata.......@......................@..@.rsrc........`.......4..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-91MRO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):85552
                                                                                                                                                                                                                                  Entropy (8bit):6.555827685237833
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9F2B3FAC3440DB16E0C13473B551D12C
                                                                                                                                                                                                                                  SHA1:FEE53A40B376900621E0F897378DE8F161AF00F7
                                                                                                                                                                                                                                  SHA-256:27C51FF3DC2F4CF2B61BDF55FB60148EF0ABB06C2FEAE188C30F1A63F9E29CAA
                                                                                                                                                                                                                                  SHA-512:31DA29833605C01AC66549170513518B634F371E5C1C724EFC92189A4EC54D4EBF8D90582AE3364BCB2B3ADDE29A2FB26BF27719B619ABB5B965C8678B96E5EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........e..e..e../.[.e...'.e..e..e../...e../...e../...e../...e../.K.e../...e..Rich.e..................PE..d......\.........." .........T......`........................................`............`A........................................0...4...d........@....... ..l.......0>...P..t...`...8............................................................................text...C........................... ..`.rdata..X7.......8..................@..@.data...............................@....pdata..l.... ......................@..@_RDATA.......0......................@..@.rsrc........@......................@..@.reloc..t....P......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-93HAQ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12304
                                                                                                                                                                                                                                  Entropy (8bit):6.694323930940949
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6C82E6BDC1D0D0746803FADAA0C5FB7C
                                                                                                                                                                                                                                  SHA1:88211EB2B86D17D343F4AEE7B338882258DE7E5F
                                                                                                                                                                                                                                  SHA-256:C41EC07B44ED1CA5B4E2A32E31D7D4EA8C31F419F9D6C5795C246D9DCEE35A02
                                                                                                                                                                                                                                  SHA-512:864ECC4856F235957EA44D84A5A71ACC1E48DF1575A606DC0150A10EFBF889FD312783C1C3E9466D715BE2A09E0DD6197E48197CBD5B82CD7D9E57BE10410995
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....t..........." .........................................................0............`.........................................0...^............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-93U17.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):627200
                                                                                                                                                                                                                                  Entropy (8bit):6.599563273610714
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:23B134891C08C7F04C1747F6BCEC06EA
                                                                                                                                                                                                                                  SHA1:26A77CCF0E62FAA436255E47A0C3C8A818733193
                                                                                                                                                                                                                                  SHA-256:E11CE4B90DB815359B2D76F95F623FC26924C5A254F0540224FA6FEB623817E5
                                                                                                                                                                                                                                  SHA-512:30C89F058B3B9DDD39ED7A3E3C470C2DF08940DBC3EA0CF72CF271FA76EE19D956EE503A3FA2839458FBD2A61658FF3AA7F8326E6ECCAE9C11AC78B4C2B84C14
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2K..aK..aK..al;.aH..aK..a...aU.Ca...aU.UaS..aU.Da...aU.RaJ..aU.TaJ..aU.QaJ..aRichK..a........PE..d....>1G.........." .....n...&.......&........bx..........................................@.........................................0q..Cx..._..(............`...E...n...$.............................................................. ............................text....m.......n.................. ..`.rdata..si.......j...r..............@..@.data....d.......<..................@....pdata...E...`...F..................@..@.rsrc................^..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9564E.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):550
                                                                                                                                                                                                                                  Entropy (8bit):5.018835920649765
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A4F947A900E60561C05F12ECC0AC9B8E
                                                                                                                                                                                                                                  SHA1:89965AACFF28DADDE79E09063B3421C1BEFFF041
                                                                                                                                                                                                                                  SHA-256:E85EA26D156723557653B22C10ADAEFDFA0D9615049541A74CDB968F146A5ACE
                                                                                                                                                                                                                                  SHA-512:38C54A752B53C60E7FE2A7C66F81757E3F047FD37339AC2B25C83B6A61320CE646C407C2AD90EB68E91702DBFFD0DD3C9A39FDDC2BA1DF6C187A525E013B7D32
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.MFC".. version="9.0.21022.8".. processorArchitecture="amd64".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="mfc90.dll" /> <file name="mfc90u.dll" /> <file name="mfcm90.dll" /> <file name="mfcm90u.dll" />..</assembly>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-95DS3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12816
                                                                                                                                                                                                                                  Entropy (8bit):6.615946138594031
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0BDE6DB4EBCBB3E639A0439B19559D34
                                                                                                                                                                                                                                  SHA1:8D17B3CE9621C690313806A82F1125E9EFCE30F2
                                                                                                                                                                                                                                  SHA-256:6D18EC951741BD2738B62C5DCCED6C9F8B9622238A26C4802556BDB8DF8A1DD0
                                                                                                                                                                                                                                  SHA-512:E2D6F60AF8DD94A060824940E4389896D3CE219408E262FD05D25FB25FBAC58C47EAACA2BC37F02EBE7339DFFF7C3E4E7098959532C3B8B05EA0110C13F9DC00
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r............" .........................................................0......;]....`.........................................`...H............ ..................."..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-96BJ9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):64528
                                                                                                                                                                                                                                  Entropy (8bit):5.5436166311209165
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:25714A7D24E8D75B240A618668BF55C6
                                                                                                                                                                                                                                  SHA1:D54573065A5B21CFBBF3FB9F07B172FC22B4C2DC
                                                                                                                                                                                                                                  SHA-256:41B7A63FE1FE274F3B7C74A75602BFDF91528E01FACC014F5C6FDA7322B54DE3
                                                                                                                                                                                                                                  SHA-512:6532080A54350492774D806A6B9F799CA5817067E999CCC901BA5D7949E89CF24B7A50999646D9E71023EEAAFECC859E46F9A1B1F4322C5CAA14CD70FCDA60E4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......F.........." ......................................................................`.........................................0...T................................"..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9AK69.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):434696
                                                                                                                                                                                                                                  Entropy (8bit):6.071763154148721
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DE588A4311344706C8068AB5B82D1ED0
                                                                                                                                                                                                                                  SHA1:4DA7331F6DC3B7F8818360574774A0ED2F91AE74
                                                                                                                                                                                                                                  SHA-256:891C58ADB569D432B50AFE6895600E5B3F0A9D967E1120617990A8B3D958964A
                                                                                                                                                                                                                                  SHA-512:6AEAB24FD5F6CE67290F9C5DB8B60530687974BF8E3F968F2A357C4C317923C468124068C371FB4558C4BA0ECAE66A345E629E27C90B7F5E2F28104E04DAD4BC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u)...z...z...z...z...z...z...z...z...z...z...z...z...z.M`z...z...z...z...z...z...z...z...z...z...z...zRich...z................PE..d......e.........." ................`................................................0....@..................................................................`...Q...x...*..............................................................8............................text............................... ..`.rdata..............................@..@.data....b.......<..................@....pdata...Q...`...R..................@..@.rsrc................j..............@..@.reloc..>............l..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9QD7I.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12296
                                                                                                                                                                                                                                  Entropy (8bit):6.642971633588889
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:97927B64D4A38E91987FCED5D39D8E79
                                                                                                                                                                                                                                  SHA1:79834D99237FACABBA6ADD6E8FB083A4607D4B15
                                                                                                                                                                                                                                  SHA-256:5B19240AA954733C60F56482BE91089E552295292D7A669418E10215C0F7830A
                                                                                                                                                                                                                                  SHA-512:6A14D66BAB6B16EF443964FB309CC42BA7FCBFC6AE746F91AF0FD748C8FDCCD638F478C807FFDB066061B6B0BD8471700992DC983446E815B4FC9731C08CE454
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...f092.........." .........................................................0......S.....`.........................................`...l............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-9UUGF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):59912
                                                                                                                                                                                                                                  Entropy (8bit):6.1727713664036825
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9DD8569FE61CDD62B5D73C5DB2B4B1CC
                                                                                                                                                                                                                                  SHA1:D93EC3D7F8D0D18AB86D883AEC914775447EBC7D
                                                                                                                                                                                                                                  SHA-256:613CB803EFD37AFA644509DF6740222306366ACC55FA434B769A11295EFEAFA5
                                                                                                                                                                                                                                  SHA-512:AE34DD69679291636CF3F13BFF4F6FB24780378CE5174D92B61C937AC1051695AE8D169ED22120C8C1E9D2FF0BB4746F586245A69B834A4D7DF52F079FAD52B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\/.+.Nhx.Nhx.Nhx...x.Nhx.6.x.Nhx.6.x.Nhx.6.x.Nhx.NixfNhx.6.x.Nhx.6.x.Nhx.6.x.Nhx...x.Nhx.6.x.NhxRich.Nhx................PE..d......e.........." .....l...P.......f...............................................x....@......................................... ...........d........................*..............................................................x............................text...~j.......l.................. ..`.rdata...4.......6...p..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..8...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-A3RLR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1756168
                                                                                                                                                                                                                                  Entropy (8bit):6.0732000418993835
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:69C3826C74C5AB669970F38EF003E8AF
                                                                                                                                                                                                                                  SHA1:F9BF244D8D2D23A99E232C551F15BACAC0B41AB7
                                                                                                                                                                                                                                  SHA-256:A0322F3D1BE69B31DFF7A03A644338DA0439BD2DCFD1F2D29F8DD8357C12EC44
                                                                                                                                                                                                                                  SHA-512:C92456233648038B35B6A393F1981BAB9775406DFDA6B1111279CD983B6909E005B516EC38A3B2533640B18CC65E9A12078C0422D2539AA172E331EFDE1E6989
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........da...2...2...2...2...2...2...2...2...2...2...2...2...2...2@..2...21..2...2...2...2...2Rich...2........................PE..d...}..e.........." .....P...N......(v....................................... .......H....@..........................................^.......4...........................*..........ph...............................................`...............................text...5O.......P.................. ..`.rdata..j....`.......T..............@..@.data...@........:...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..2...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-A99MS.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):44552
                                                                                                                                                                                                                                  Entropy (8bit):6.215890984145544
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1D014DE0C32B01DBA026BEB74E49A2A8
                                                                                                                                                                                                                                  SHA1:A62DD33E2E1A66952A370743333F51EFABF3F835
                                                                                                                                                                                                                                  SHA-256:5290D120E1088F0A3E48F7FFBEC678AD6FAB79E3C38DA8BAD361E7FE1B87A346
                                                                                                                                                                                                                                  SHA-512:506C850940F402C33F5448052C3C5571A0D274FADE5FE4D76832C7EC6449AF4273EDC16313B4B0A55FDA1C5175748B6879ABD3AA568311E89D5375C762BC276F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yO..=..=..=...aT.?..4VW.?..4VA.6..4VF.5..4VQ.:..=..y..4VH.8..4VP.<..#|V.<..4VS.<..Rich=..........PE..d......e.........." .....L...4......@Q..............................................F.....@.............................................f....w..P........................*..........pb...............................................`..8............................text....J.......L.................. ..`.rdata... ...`..."...P..............@..@.data................r..............@....pdata...............t..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ABATK.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):43264
                                                                                                                                                                                                                                  Entropy (8bit):6.628345446100462
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:61D52D5D75CA14A2095CA9E984B4F6EF
                                                                                                                                                                                                                                  SHA1:B2F437DDF1AA3473618D2F2870970F2DB39E5CC2
                                                                                                                                                                                                                                  SHA-256:8B1F9DB2B663E66DC92AEFBC8AFD5C46186C385AD34C587A2D7B00AD51340F14
                                                                                                                                                                                                                                  SHA-512:D02B281B37FAF60947B123A33D0E1F35C261B0C47CF71320147E31F5016DFB150417B64CBABC30C4F270E84887B80DAF16695A49408DF20703F592168BD96E58
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U&..4H..4H..4H.]....4H.]^I..4H..L..4H..4I..4H.]^K..4H.]^L..4H.]^M..4H.]^H..4H.]^...4H.]^J..4H.Rich.4H.........................PE..d......\.........." .....:...2......PB..............................................0b....`A........................................ g..X...xg..x....................j...?..........`^..8............................^...............P..X............................text....9.......:.................. ..`.rdata.......P.......>..............@..@.data........p.......\..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc...............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ACD30.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):71176
                                                                                                                                                                                                                                  Entropy (8bit):6.194317190283573
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5FD5DD3314050EC71B57E4D9F5BA5A8D
                                                                                                                                                                                                                                  SHA1:69651A725B7E596BB7434A642EEADA7D363E9AE4
                                                                                                                                                                                                                                  SHA-256:C4C95A65D7837014A6D1F486654972C00D6FB0BEFB6487B07FACE3E88EB26AD5
                                                                                                                                                                                                                                  SHA-512:430C611C706FFD9DB5F2413BD00FDB7E133C77A2ECE88FD7F20F22CCE41DDA7B7C605770CC6B6F9AA4447259A321D5BC1C112890C7F4F25F87B2D485BF9C5D66
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.6.?.e.?.e.?.eGpWe.?.e.GTe.?.e.GBe.?.e.GEe.?.e.GRe.?.e.?.en?.e.GKe.?.e.GSe.?.e.GPe.?.eRich.?.e................PE..d...J..e.........."..........f......xy.........@.............................0......c.....@.............................................h...4...x...............@........*... ......@................................................................................text............................... ..`.rdata...N.......P..................@..@.data...............................@....pdata..@...........................@..@.rsrc...............................@..@.reloc..6.... ......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-AH9DR.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):145416
                                                                                                                                                                                                                                  Entropy (8bit):6.857575385196831
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EDBEF6D7C7104F5980A47DF6C31C0EB9
                                                                                                                                                                                                                                  SHA1:EFCD69FB7B089FD13C604374093614E862A30F48
                                                                                                                                                                                                                                  SHA-256:20A0AF4D3DFEB773713EDF9F3D0537B2693DBAAB4F855DC9FABCB1BC88EFB222
                                                                                                                                                                                                                                  SHA-512:3170B33D2B377EBA3FF6925C553C8A8EE363244F783FCAA6F3EF885D3AFA754EA6EB93859F2847582C73D37EFD751AD9C230B66D20227556D1DE333FEA625DE8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(.,zl.B)l.B)l.B)..)m.B)e..)n.B)e..)a.B)l.C)..B)e..)x.B)e..)j.B)e..)d.B)e..)m.B)e..)m.B)Richl.B)........PE..d...$..e.........." .....B...........F.......................................`.......P....@.............................................a............@....... ...........*...P......0c...............................................`...............................text...Y@.......B.................. ..`.rdata..1....`.......F..............@..@.data...............................@....pdata....... ......................@..@.rsrc........@......................@..@.reloc..6....P......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-B3QPI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):15880
                                                                                                                                                                                                                                  Entropy (8bit):6.447776302900069
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F1966E566459389D610B3773C3E065F1
                                                                                                                                                                                                                                  SHA1:E123168541D78E792D8CDBAA6B473F28C1064954
                                                                                                                                                                                                                                  SHA-256:DB128A378C682A0ACD5FB4D074B45FAD33AB57E70637F3EFF917562D8100923A
                                                                                                                                                                                                                                  SHA-512:A0D2F959CD28B48791D60BF7488AA26231439C83DFC9E474F17144963BC57F143FD3E0F1904B63948334D3A83B9A5BDD3B2DAD81F2E6584303C1C9BFAA9A9C78
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...x............." .........................................................@............`.........................................0................0..................."..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BPQE8.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12304
                                                                                                                                                                                                                                  Entropy (8bit):6.701794840167942
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:54A1DED1160D8E7A02307B63C191E42E
                                                                                                                                                                                                                                  SHA1:BE3DE75C0FCC802D2CFCB759288313ABCFFD2EB9
                                                                                                                                                                                                                                  SHA-256:ACC5C813E40E55C5C242057AB15F3D9049850D7345D8509F7044BC905DD3AA3A
                                                                                                                                                                                                                                  SHA-512:41A1ED1393857B38137CCC91C5519DBF2D054826515F321F2CBB86A21D7086AD5098FE6A2DA9173F32B8D7FCC41A893C742DA0FDA99F8BA179254CD2097C59A0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...+P............" .........................................................0......".....`.........................................0...e............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BRP9L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2605568
                                                                                                                                                                                                                                  Entropy (8bit):6.366298142255271
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0C3EA35548698D9A7D7B79A57AC3A3DD
                                                                                                                                                                                                                                  SHA1:920F80290E08DA4D2A1FC6CBF3FAC649DE6BEE51
                                                                                                                                                                                                                                  SHA-256:FB3BCF1715EAD7930F7E6BF8A250F6B734793623B9C7B9AF3EA4B907EAF00D7C
                                                                                                                                                                                                                                  SHA-512:9538497E580AAF02C8F193ADC7AA95419C1A052B11675A24CCD62A78215931B0D40B0576BC147B16DE53D03863480F2F8594CEE2EF835F5FA88924E489F90106
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........et..............|......l......l......l......l......b......dm..............dm......dm......dm......dm......Rich....................PE..d...Uu._.........." .....(...........q........................................(...........`.........................................`... .....%.......'.......&...............'.,&.. ...T............................................@...............................text....'.......(.................. ..`.rdata..h&...@...(...,..............@..@.data....M...p%..F...T%.............@....pdata........&.......&.............@..@.rsrc.........'.......'.............@..@.reloc..,&....'..(....'.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-BTT9D.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):103944
                                                                                                                                                                                                                                  Entropy (8bit):5.922370741464423
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:45E1EE96B93ADC5E4C804F5853BFF163
                                                                                                                                                                                                                                  SHA1:9BE871B9E68521CAFBABA0C1CA7E45D42E30BC8C
                                                                                                                                                                                                                                  SHA-256:C1F17370F2CA73F6A27A0AFCBEB516C6DE87843F4845B78692DCF426C4658B59
                                                                                                                                                                                                                                  SHA-512:6DE577EC5B9D0902AD6C41FD4C836247A4346D0EB3B94E408F6F8D193639F7DBF5B8D482C1B8617E7485BFBF1411C847B9A7F432592FAAA45C0C56ACB12C345A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:..:..:...u].:..B^.:..BH.:..BO.:..BX.:..:...:..BA.:..BY.:..BZ.:..Rich.:..........................PE..d...`..e.........." .........~............................................................@..........................................^...... K...............p.......l...*..........p...................................................0............................text............................... ..`.rdata..2_.......`..................@..@.data...H....`.......N..............@....pdata.......p.......T..............@..@.rsrc................d..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CICTF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):269832
                                                                                                                                                                                                                                  Entropy (8bit):6.418519233215712
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EF3990748342BB53ED5FC3F84472C687
                                                                                                                                                                                                                                  SHA1:C69EECB3715C9ECE3300DEB29B827115A5B4B65A
                                                                                                                                                                                                                                  SHA-256:EE4CAD49258F162FA0DF29014CE46F489A38AC592CE8E201044857E4A3947CE6
                                                                                                                                                                                                                                  SHA-512:35643E8DA9C31C5E890AA143630F135257C43A1C12FCE0D2CF4A9B0264ED48E97E8D23A20157C31C97EDB0BFF17016952C0DB88E97E49FDBB389B015E5B1E0DF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.F..@...@...@.TB....@..u....@..u....@..u....@..u....@...A...@..u....@..u....@..u....@.Rich..@.........................PE..d...w..e.........." .........................................................@...........@.........................................0....S.....P.... ..........0$.......*...0..x....................................................................................text...o........................... ..`.rdata..............................@..@.data...............................@....pdata..0$.......&..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CLQEB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1235976
                                                                                                                                                                                                                                  Entropy (8bit):6.092279733218295
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EA2B0322D0C86E82B2001AC152D5D0C9
                                                                                                                                                                                                                                  SHA1:E5DFB1E934010E1A89A427DB8F04C3775A83752A
                                                                                                                                                                                                                                  SHA-256:B3B56D9D5C6F12A5C41CC33CE4FA7D9B107ACF74A22DD285C806CFD15A9A630B
                                                                                                                                                                                                                                  SHA-512:D020A84C0E9FF179CCE8C85A2A46501E73AD7058B07C53834F99C9C81D4478F7079E7B079FCC1CEF307D2124013CF999D648AE273477A38C0B99528A5E2ADE26
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.Rwv.<$v.<$v.<$..$t.<$...$t.<$...${.<$...$..<$...$}.<$v.=$..<$...$i.<$...$w.<$...$w.<$Richv.<$................PE..d......e.........." ................ !..............................................'.....@............................................c...L...x............0..........*......h...@................................................................................text...U........................... ..`.rdata..3...........................@..@.data....g.......\..................@....pdata......0......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-CQ1FT.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):13840
                                                                                                                                                                                                                                  Entropy (8bit):6.5907440700460365
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DFA89D4A72751091108FC3C08588D2B7
                                                                                                                                                                                                                                  SHA1:95052FF76ED7A19E07AD3B322A6EE8CC8340BBB8
                                                                                                                                                                                                                                  SHA-256:D517A0B9673EEFDCFC83FC8E03DCF5057EB1689B94E67D493AF0C16728486245
                                                                                                                                                                                                                                  SHA-512:7BA8465CD431C21858BA256438DDC4EFE5A20F48D320A3B97A9F1FD2C7F9A782B1DF8A620438A7A6FBBF0FA4A2B5EA4072DEA2575ED3B9BFC0187DA2093E6E75
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0............`.........................................`...X............ ..................."..............T............................................................................rdata..|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-D5255.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):30768
                                                                                                                                                                                                                                  Entropy (8bit):6.425404723050243
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:51039F47A896DC825C1D508B1C4B98E4
                                                                                                                                                                                                                                  SHA1:B21E93FB4D829692A5DCF3A933B44F154AD83BA9
                                                                                                                                                                                                                                  SHA-256:6EE89634A4174AFD3BEE845CF08CB5A771289E3E1AD4284B9DAC6664B2A97796
                                                                                                                                                                                                                                  SHA-512:7E77A28E4E45E6578C12087E3403DEA3EB7D5C18B91C4E407C9A3DB39FF8BF7D91C0400BDA3F72E1B106EDF4E6825FA6D08D341284A2A7BAA344665190F20A54
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T=..5S..5S..5S.x....5S..M...5S.x_W..5S.x_P..5S..5R..5S.x_R..5S.x_V..5S.x_S..5S.x_...5S.x_Q..5S.Rich.5S.................PE..d......\.........." .........$......`...............................................P.....`A.........................................>..L...L?..x....p.......`..@....:..0>......d...03..8...........................p3...............0..@............................text...3........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..@....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..d............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DA21K.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11792
                                                                                                                                                                                                                                  Entropy (8bit):6.630233426489395
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6CCF0CA512B9420990C22D462ABE3B08
                                                                                                                                                                                                                                  SHA1:4F2F516A90CD06FB132B794762872BA19CA51CBB
                                                                                                                                                                                                                                  SHA-256:F8F460FB6A3AE59DC83E8C398757C9D4999A54FB14F5E4B33B09140158AD0762
                                                                                                                                                                                                                                  SHA-512:B75BD6DF0A4BD2754223BB5821A3C6D3DCABE1C41630822106E12235B9E1B3C0155F5CD41AB56FF0D0EC05864289F2EF1FB1D8C58BE77C1AE36D48E89862A66F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0...... >....`.........................................`................ ..................."..............T............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DBH01.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):31240
                                                                                                                                                                                                                                  Entropy (8bit):6.597679161346458
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6584C8E80981D3D810F434585BC8FAF4
                                                                                                                                                                                                                                  SHA1:13D3463E2739E8E8606CB40E39BC5FE5B4EB4567
                                                                                                                                                                                                                                  SHA-256:F494705E5AA05D2D7B039D940F5F774F5368F978B26E6D459F49CCBBC4AFF320
                                                                                                                                                                                                                                  SHA-512:515CB4BBA8C28903E4866CBFC2BD27A0CE8C9D261DC6D999CC13D50334013AE1AA17B4C4F2319FB70F1B8C8A7E0A454684F21D898DCEE0C010019AFBB6742FDD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K............0.......................................................................Rich....................PE..d...o..e.........." .........2....... ....................................................@..........................................C.......<..P............p..|....P...*......(....1...............................................0...............................text............................... ..`.rdata..X....0......................@..@.data...@....P.......6..............@....pdata..|....p.......F..............@..@.rsrc................J..............@..@.reloc..\............N..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DG7RH.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):21000
                                                                                                                                                                                                                                  Entropy (8bit):6.559119140616016
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EDB1183017658C1A00FBD604D84A2B8D
                                                                                                                                                                                                                                  SHA1:B4EAD4271554CB48D5F72859AF9630E90B13E848
                                                                                                                                                                                                                                  SHA-256:4CAABE7B5F752AC98956A2B824A92099EFFFFA00DEDA4A53D287601F2CD2BA10
                                                                                                                                                                                                                                  SHA-512:36990F37CCF05BD411FB6476A38F114F0070EF49B874909675DD9761622DC13DE5527A95ED12D41B7B612E11C07A23A537E5D328AA9F482C768FB4DF74133EB0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!K..@%..@%..@%..8...@%..8...@%..@$..@%..8...@%..8...@%..8...@%.Rich.@%.........................PE..d......e.........." ................X...............................................0O....@.........................................`;.......5..P....`.......P.......(...*...p.......................................................0..h............................text...!........................... ..`.orpc........ ...................... ..`.rdata.......0......................@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........`......."..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-DO9UM.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):60722432
                                                                                                                                                                                                                                  Entropy (8bit):5.524405817082764
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A7D686A4C93043023C2EEEB43F49266D
                                                                                                                                                                                                                                  SHA1:90B2EDA2F38B923F0CF686786DC0C693FA35F24D
                                                                                                                                                                                                                                  SHA-256:DF69DCB341C252BC5EB184AA1156CA3B94551F8AB82CA15998516EE9A17E1DC7
                                                                                                                                                                                                                                  SHA-512:FE60C33E4837DFE1955918119795BD861E285620DACF585FA72A465C7BCC6E161336EF29D7FAEAFF67F3486C80B6689185496678D7648398336AC7CC5DD02012
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e..j.......& ...............0.........\e..............................r.....[....`... .................................................@..............`....b...*...@.. ........................... ..(....................................................text.............................`.``.data.............................@.`..rdata..............................@.`@.pdata..`..........................@.0@.xdata.............................@.0@.bss.................................`..edata..............................@.0@.idata..@...........................@.0..CRT....X.... .....................@.@..tls.........0.....................@.@..reloc.. ....@.....................@.0B/4......P....0......................@.PB/19......&...@...(..................@..B/31..........pX.......P.............@..B/45.....we8...X..f8...P.............@..B/57.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-E4L6V.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):106504
                                                                                                                                                                                                                                  Entropy (8bit):5.856298013029967
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DCB947F7E3CB5391B399AA0FB8793ABE
                                                                                                                                                                                                                                  SHA1:CF6A0A4E4F358F3D1D6AA74E6DD09AF96D77534E
                                                                                                                                                                                                                                  SHA-256:7E35624AF9C52CEE5FDBE200B82EDDE5DECBE27EA70B41D135B366BFEAE0BD62
                                                                                                                                                                                                                                  SHA-512:E99FEFF77D75405CA611A57031858CA55B789E3CB20B6191C8B67477E3868DA0CA7B9C25615DE855F01733DEFC7D15EED8B93B97EBAB276019266428F2C03990
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]T0..5^U.5^U.5^U.z.U.5^U.M.U.5^U.M.U.5^U.M.U.5^U.M.U.5^U.5_UL5^U.M.U.5^U.M.U.5^U.M.U.5^URich.5^U........................PE..d...t..e.........." ................(.....................................................@..........................................q..k....e..x....................v...*...........................................................................................text...e........................... ..`.rdata..[b.......d..................@..@.data...(............Z..............@....pdata...............^..............@..@.rsrc................p..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ETQ91.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):169480
                                                                                                                                                                                                                                  Entropy (8bit):5.8550515391835
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:84686C294FD1F911193A28484A504F47
                                                                                                                                                                                                                                  SHA1:A2D303A2CB902AC7517FAF1B756B2682DD6C118C
                                                                                                                                                                                                                                  SHA-256:C529A2ACF61D5A9D4E5F6D34C5DA40B89855E139AEF94B14D3C48784FA99FCAF
                                                                                                                                                                                                                                  SHA-512:9924C00722200C77F2857D712D47D53D6093EAB7E1403D4D3FFDCDF98D5C24FE185DE2842436AB45BADEE713E4FFE3D9E149BA89E5EBDDCAECC86DB35482FCCD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..o..o..oh.Ho..o..Ko..o..]o..o..Zo..o..Mo..o..o...o..To..o..Lo..o..Jo..o..Oo..oRich..o........PE..d......e.........." .................................................................r....@..........................................L......<)...............`.......l...*..........p...................................................8............................text............................... ..`.rdata..............................@..@.data...0....P.......<..............@....pdata.......`.......B..............@..@.rsrc................`..............@..@.reloc..x............h..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-F4B9A.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11280
                                                                                                                                                                                                                                  Entropy (8bit):6.780444478337169
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:98C7553268014D1A9B4B451EC44292E4
                                                                                                                                                                                                                                  SHA1:07B03A88258C5FC97358720CF4142698A3C2022D
                                                                                                                                                                                                                                  SHA-256:AA48FCE35A1B7AD8C03703C5821DADAA69D1773000505D988B4C0611A9BBFE2B
                                                                                                                                                                                                                                  SHA-512:09AC5444EAC1AF2717C675C8B23F4B13AF4AAA2E0E61C1B2BFE32DDDD67B610684CB39F3FF475C95ED9EC9314FB70D3CE5E5464ECC56FBC2E1E96CA5B6D43EB3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....f............" .........................................................0......W.....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-F8JB2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):117256
                                                                                                                                                                                                                                  Entropy (8bit):5.923948988786656
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:77F49FD768A1CE33F915322F7CD6C49D
                                                                                                                                                                                                                                  SHA1:74E93D168D3C1793A5CAB2205B0A0F9082C8C09F
                                                                                                                                                                                                                                  SHA-256:8DCA6EAF509A0EBFD63EC1868F409BEEED107A31CEA9681A826A26A62B82FE65
                                                                                                                                                                                                                                  SHA-512:D6C2EA04D707C621964331CE88D152EDB9EC6D544B390FD8543D9B88283B4A53F00409AE7E5191525D88DBB969A5FBACC31B53B9B0A91691F609BA97F3442346
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~..~..~......~.....~.....~.....~.....~....!.~.....~.....~.....~.Rich..~.................PE..d......e.........." ................P.....................................................@..............................................................................*..............................................................`............................text............................... ..`.rdata..............................@..@.data...@............~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-FRKA2.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11792
                                                                                                                                                                                                                                  Entropy (8bit):6.744878836757168
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6A90021A45818AFF3390438EEFC9B787
                                                                                                                                                                                                                                  SHA1:84E2A69F2F6C0DFCCA296BCEE032C1E0C19641BE
                                                                                                                                                                                                                                  SHA-256:A8515699A009E0E028B44851C02AA0F794D1D1B41A73772B98573754424E1025
                                                                                                                                                                                                                                  SHA-512:DDF441775EE6FA741A96F19D2D4EF208CE9B545672CA4B68C4CDDAA6C1D6032BBC1AA4E58C087CEA6AC8C2A4F69BD54541B83EA082F2F32E76F41C22C9C990B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....%..........." .........................................................0......Y@....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-FRMBO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):200712
                                                                                                                                                                                                                                  Entropy (8bit):6.310794332516682
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C18CEFA67EA7BE11D5BD37054DC9CFDD
                                                                                                                                                                                                                                  SHA1:06083CDF5A60BEFFD9C730FDDF160EC427F4792B
                                                                                                                                                                                                                                  SHA-256:E9A065A47B10F2D06B1F041FF5DFCD928A5F2F0478AA6099E2CDBABB8CE46511
                                                                                                                                                                                                                                  SHA-512:DBE9B85023E4BBC590F2ADE7A3E9C4723CE7BD36470F24EFB923374D4ADE1840FBD10C32C854B593122D5DF37E9BE73A26EDC5E5D6716CA7B78F6FFDB27EF790
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*6..KXZ.KXZ.KXZ.3.Z.KXZ.#\[.KXZ.#[[.KXZ.#][.KXZ.#Y[.KXZ./Y[.KXZ.KYZ.KXZ."Q[.KXZ."X[.KXZ.".Z.KXZ."Z[.KXZRich.KXZ................PE..d......e.........." ..... ...................................................0......^1....`.....................................................,........................*... .......j..p................... l..(... k...............0...............................text............ .................. ..`.rdata..6....0.......$..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-H203L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):550408
                                                                                                                                                                                                                                  Entropy (8bit):5.926651771970081
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A56061A426047A0A716DFCAE89A1FD3C
                                                                                                                                                                                                                                  SHA1:25C8D99635F5108DBD514BE6C023A3E78F51DF4C
                                                                                                                                                                                                                                  SHA-256:8D50064838EB70863EB5A7CD6378140EB372E1A86659CF4DA26C6DECB45D4ACA
                                                                                                                                                                                                                                  SHA-512:13BE1D82B3C14994A7E40B4EECD6FCB766E9788B43B094CFAD5B4F91E99EDCA8F377081BB3F7878AFE25A47B8636B77094CA5A5887DC6D1E58722031DA144AA1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i....j.h...`.i.d...`.......`.x."...`.o.b...i.......`.v.a...`.n.h...`.m.h...Richi...................PE..d...r..e.........." .........B.......[..............................................t.....@.........................................p...........x............ ..._...<...*......t....................................................................................text...z........................... ..`.rdata..............................@..@.data...d\.......(..................@....pdata..._... ...`..................@..@.rsrc................,..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HD2M3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1859
                                                                                                                                                                                                                                  Entropy (8bit):5.368960172138106
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CFDFB365D8F581E80292124EEB97854F
                                                                                                                                                                                                                                  SHA1:7CF6859AE9693EAD128A40F7F36B2EBAF9CE923F
                                                                                                                                                                                                                                  SHA-256:F20BC224A6E3EF391C67FD91378E2EC9734E450EA30AC1D6B84E5ACB4AC9A087
                                                                                                                                                                                                                                  SHA-512:309D66CF8A3D026A00B90E635BE2535F9E13489CD35A89532D304AB3FF026B914AC508C4F1314BBD72CEFEC8303402F45FF63EA31E66CFE9480F586F8688720A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="b2f60c4aac5e14a70e51af1adfb7a3e3c8d78974"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Jqd8zw5i+qQ2JV5HoMPIqBhzMZM=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="a41203d30322a6320bfef2ba29f48899a5b1d608"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:ds

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HDHPK.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):19984
                                                                                                                                                                                                                                  Entropy (8bit):6.203838496280811
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:18B875B9075AC3BF21FC8DB56D774ED3
                                                                                                                                                                                                                                  SHA1:DA8802907A4DB504BF694465BBCF4A1C5BFC49BA
                                                                                                                                                                                                                                  SHA-256:343B5FED7783130B1E96C524E8CC84FD0F690A66614756A5EE117B35AD1087E3
                                                                                                                                                                                                                                  SHA-512:F85CBB31A24CA5DDEB3589889D23C415A9798AE8F80F5802A60075AC04A23904E13921DAAB311210169AE11716DF4CDD9605F930E84EECE2C70E1D33FA06AED4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.../..N.........." .........(...............................................P......n6....`.........................................0.... ...........@...............,..."..............T............................................................................rdata..$".......$..................@..@.rsrc........@.......(..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HLN36.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11792
                                                                                                                                                                                                                                  Entropy (8bit):6.751712698504427
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F12C1674574B16DDC17F4CCF68955E59
                                                                                                                                                                                                                                  SHA1:0C7D9B8B504A3DDC53C0B8E4066C8D829E65AE55
                                                                                                                                                                                                                                  SHA-256:A88202B5B8E62EDEAFB536AF25580B2B1A437860D86CD5D8A6FBA3C89B46ACD6
                                                                                                                                                                                                                                  SHA-512:084776CB0C9E7E3708CD67BD2E075BD6878A13EC0DD70F46ABB7532E7153DDC4C5AFBCBBD477A62432BEF0E1381E06A16F951F7C701B1C6EADEC93514834BB39
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......R.....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HNUE0.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11792
                                                                                                                                                                                                                                  Entropy (8bit):6.692027910322985
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1F52092CB4538F17F3EA7D62DB31BE0F
                                                                                                                                                                                                                                  SHA1:C9282A2D4B603367A6717A9BC3D59D7DA784B967
                                                                                                                                                                                                                                  SHA-256:876EAB922FFFF0DC4314ABCC212580BA8D3346B45EA2E51930C7CC8D6C5A43EF
                                                                                                                                                                                                                                  SHA-512:92C785BB1988EA3C61E0D2E031D426EAE87563C56741F82F0240B3BCF463EC733BA25AA1A7A1D776F1C14672266A22A997867C578A91D3B270696ED1DD7C3B21
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....<.........." .........................................................0.......Q....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-HVFFB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):220168
                                                                                                                                                                                                                                  Entropy (8bit):6.2350278953740945
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7E84C73E74FB9BF6BD6950C1C92101EA
                                                                                                                                                                                                                                  SHA1:0855F17FB7CB60E07EBB92F83054D08F9B086A75
                                                                                                                                                                                                                                  SHA-256:2ED9DDB2BA74A9EE139CEA6EA5B05C74FB671235D3D9AAEE0AD1234774528C63
                                                                                                                                                                                                                                  SHA-512:F861841593383EB556AC90F16D1229C6FF2D3F0D361708DC8FE60BFD2AFFDCC49D97911B7C53AEEDE276DBFC6904BE46C1233F0C166C310797C7C307FF4BF145
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..J...J...J....UC.K...Cb@.H...CbV.A...CbQ.C...CbF.A...J.......Cb_.D...CbG.K...THA.K...CbD.K...RichJ...........PE..d...3..e.........." .....Z..........|J.......................................p.......h....@.........................................0...........x....P....... ..p#...2...*...`......Pt...............................................p...............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...............................@....pdata..p#... ...$..................@..@.rsrc........P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-IF1J1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12816
                                                                                                                                                                                                                                  Entropy (8bit):6.654452573199329
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B39818632A1E37FFF6BF0DDA3F2C1732
                                                                                                                                                                                                                                  SHA1:8F49FD8E54A3FC93B89B75B4EF1741E08880DD29
                                                                                                                                                                                                                                  SHA-256:24D1AB93B6799378C110E0DD164D82C39AF1B8FB50BCCB754B1B52B3B68752A1
                                                                                                                                                                                                                                  SHA-512:085902A0AFA9B6868C0F7D91B2C45A5A780EE154A0A39BF733A27D4CFFFE0FA9B4CAB91503EDB01344CC5B664C768F72063EBDF588AB5019D1A53F2D43F0E8C4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d..../}..........." .........................................................0......R.....`.........................................0................ ..................."..............T............................................................................rdata.. ...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-IN45A.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):829264
                                                                                                                                                                                                                                  Entropy (8bit):6.55381739669424
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DF3CA8D16BDED6A54977B30E66864D33
                                                                                                                                                                                                                                  SHA1:B7B9349B33230C5B80886F5C1F0A42848661C883
                                                                                                                                                                                                                                  SHA-256:1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36
                                                                                                                                                                                                                                  SHA-512:951B2F67C2F2EF1CFCD4B43BD3EE0E486CDBA7D04B4EA7259DF0E4B3112E360AEFB8DCD058BECCCACD99ACA7F56D4F9BD211075BD16B28C2661D562E50B423F0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........pm...>...>...>..>...>...>F..>...>...>...>..>...>..>...>D..>...>...>...>...>...>...>Rich...>........................PE..d...J._M.........." ..........................sy............................. ............@.........................................pt.......`..(...............pb......P............................................................................................text...F........................... ..`.rdata..............................@..@.data...L}... ...R..................@....pdata..pb.......d...Z..............@..@_CONST..............................@...text.....2... ...4..................@.. data.........`......................@..@.rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J137C.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12816
                                                                                                                                                                                                                                  Entropy (8bit):6.6087802749046345
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AD262469A5A85FA1B1B2922EEFAD6823
                                                                                                                                                                                                                                  SHA1:123B05CF8A10437C9B6DB7357A1609F19B31D841
                                                                                                                                                                                                                                  SHA-256:A92B9E28CBF9B617D196B28EF8D7C2CDD311D2B48A41B08E7B5566B8BE04151C
                                                                                                                                                                                                                                  SHA-512:ADCF83D42FC8BA1F7FA968D6D7EF9C50AB6A1BE49B8D998660C5CA04D286C6188E1B90D7AABBA56E649415EB00C232AF9A51879ADB09CAC51C4F5D6AB6FFFB2E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0.......x....`.........................................`................ ..................."..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J1L89.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):186888
                                                                                                                                                                                                                                  Entropy (8bit):5.748928908298283
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6F89D00A2F6FD1CB33D5DA6FD97A050E
                                                                                                                                                                                                                                  SHA1:2E26A9E48F3A7E14DCE16E115FF7FFB6DA0EFECE
                                                                                                                                                                                                                                  SHA-256:C4A7C9D1EB6C5E9080AAA9A7E8C1A9CC6463BBABF3B40906F11B749923A594A2
                                                                                                                                                                                                                                  SHA-512:4BCA08354417D875EDCBE0206F371593CA5452288F0FDD3ADA2A960F39932145C644FF85B9F033D9B80A3EB722F55FAE69ADBE4EE90E8476AF15378A32E353F8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TE...E...E.....}.G...L.~.G...L.h.V...L.x.V...E.......L.o.T...[...D...L.z.D...RichE...........................PE..d......e.........."......$..........|'.........@....................................dC....@.......................................................... ..8................*......4....................................................@...............................text...A".......$.................. ..`.rdata..l....@.......(..............@..@.data...............................@....pdata..............................@..@.rsrc...8.... ......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-J1TL9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):551944
                                                                                                                                                                                                                                  Entropy (8bit):6.360509313354498
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:420AB8712A175F1D65CE6D253E5A747D
                                                                                                                                                                                                                                  SHA1:19A3C6142455F8CED44A4D174686F8306313EC94
                                                                                                                                                                                                                                  SHA-256:314A4337C9321C32FBEF8C6CAEB9D1AE6434376CC5B00710D2A7DC37A41A214B
                                                                                                                                                                                                                                  SHA-512:6A60146BACD2AB4E2C43283B21C2E26B012D6D9AD4119D8D753307A41249DA8D7BD97268D2D76C20CDD4D0E55A23B0DE8271433632A8CADE08E2DEFCEEE520C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5...5...5...M...5...M...5...M...5...M...5...5...5...M...5...M...5...M...5..Rich.5..........................PE..d......e.........." .....T...........]..............................................p.....@......................................... !..I.......<....p.......@...*...B...*...........q...............................................p...............................text....S.......T.................. ..`.rdata..i....p.......X..............@..@.data........0......................@....pdata...*...@...,..................@..@.rsrc........p.......:..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-JC1B0.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1740678
                                                                                                                                                                                                                                  Entropy (8bit):5.982630835595894
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6EC706E01FA5EF7A4E74526DD6CEEA22
                                                                                                                                                                                                                                  SHA1:C93AF437026AE0CB191B02A34F5413B419005872
                                                                                                                                                                                                                                  SHA-256:2162FD773DAFBB41EB422418761EADE228321AB0790040646028C5F4F867EE42
                                                                                                                                                                                                                                  SHA-512:AC1ED72862E1413FE1909A993D96440CE865932AE6A637E47C49E8A44C0C8F5A8C2E094A38FD3E3124A9BAEEED79393ED8B60904CBD0AB77E5B0DE4083F05958
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...BX.R....!.....& ............. .. ..........p.....................................b........ .................................................l...............................<...............................(...................`................................text...p........................... .P`.data...............................@.`..rdata...).......*...d..............@.`@.bss..................................`..edata..............................@.0@.idata..l............T..............@.0..CRT....X............j..............@.@..tls....H............l..............@.`..reloc..<............n..............@.0B/4......`...........................@.PB/19.....w...........................@..B/35.....T.... ......................@..B/51..........0......................@..B/63.....+....P......................@..B/77.....|....`......................@..B/89.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-JIO6O.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):401928
                                                                                                                                                                                                                                  Entropy (8bit):6.00173064542256
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DCB51FD170BAD388A5F28343E2875AEC
                                                                                                                                                                                                                                  SHA1:5A4F7DD3CA546A0818544CC195892C929736CB7B
                                                                                                                                                                                                                                  SHA-256:AFBBEB605109AE168A447D749EACC2F43D639A92EC380118E85AC83BE5855E69
                                                                                                                                                                                                                                  SHA-512:B197B62F288278A6E5456566A2900B6A64AB27AA42ED0C39239717B578531891D786876A64FADBC540A725E5561167C9757DC09344645F8A0600697D02D1CF31
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.v.x...x...x...q.......q...u...q...1...q.......x.......q...~...q...y...f...y...q...y...Richx...........................PE..d...p..e.........." .....P........................................................./.....@.........................................p...........P....p....... ...@.......*......L....d...............................................`.. ............................text....N.......P.................. ..`.rdata...0...`...2...T..............@..@.data...Xu.......$..................@....pdata...@... ...B..................@..@.rsrc........p......................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-KP53P.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):65544
                                                                                                                                                                                                                                  Entropy (8bit):6.266793345872348
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6C8AE9DCA4EBB34159805BDA29FDDC32
                                                                                                                                                                                                                                  SHA1:2C77FAAC60028D19FCF2D6CB9C77309D83E7F0EA
                                                                                                                                                                                                                                  SHA-256:843B4A1FCC5E3BB7841A581CAE391D18CB9EE320F6B2F1A7E0D37CD1B4AAF851
                                                                                                                                                                                                                                  SHA-512:79502E60C470D252FBE7154760AB32CD09F97C5769C8EF9DAADE0ED4EC79A6C9F7C41419AC421DD29B33FA886B1D6FFF565DB2F315DCDB176337FACA1A00C237
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................../.%.......&.......0....... .......7....... .............9.......!.......".....Rich............................PE..d......e.........." .....|...V.......w....................................................@.........................................@...........x........................*..............................................................P............................text....{.......|.................. ..`.rdata..!=.......>..................@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LAIV4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):16400
                                                                                                                                                                                                                                  Entropy (8bit):6.462937749825311
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AFD2D84FB1CDD0C03EE2888CE4FADAFC
                                                                                                                                                                                                                                  SHA1:C2EBE9EDE75C0956F7D8431B0EA345672132A2D3
                                                                                                                                                                                                                                  SHA-256:26CE526A30CEB11AAD52B71AA4F3EA65AFE2FD6987AB517B7E86823687BE6D2C
                                                                                                                                                                                                                                  SHA-512:DEA9F4737881C4CE5591EBE9875E0981DC360DF56505D8CD9204FB15C08FC84C1B634957540A22B11C222A11F1C99A2B401DA50E55C8964C91262B186C030410
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...9..b.........." .........................................................@......./....`.........................................0...4............0..................."..............T............................................................................rdata..d...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LE083.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):412048
                                                                                                                                                                                                                                  Entropy (8bit):6.554601083505528
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5515F09DAD426BDBE97C36A2695B98DC
                                                                                                                                                                                                                                  SHA1:D29D07F2D2C0B6FF0EC61E096FA970971A948E3D
                                                                                                                                                                                                                                  SHA-256:225279F5AE5B24A3019E8D8D7D007FCC1F891966889619DD31B942A5DE908E31
                                                                                                                                                                                                                                  SHA-512:26E4EAD65F5B900DB588BE763965A02E02D5E362878B895FC553ED6E3D66E1DF037CDF46E5FAE8F62D523B8885E9EC9AFDD1B06A2D1054E0C395B6BE77828235
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b.......................................>...7r..............Rich............PE..L.....[J...........-................W........................................p......4.....@.........................0...t...<...........@5...........2....... ..4-.................................. ...@............................................text............................... ..`.data...0...........................@....rsrc...@5.......6..................@..@.reloc...@... ...B..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LGHNL.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):37384
                                                                                                                                                                                                                                  Entropy (8bit):6.271838803517858
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:67019047BEB2BFC991ED3AEB781191CF
                                                                                                                                                                                                                                  SHA1:BDE2060B9007C18F9998643F197E2BA351605AB9
                                                                                                                                                                                                                                  SHA-256:A3B092FD0C92408F8F572D1A9155499F8B9689DF8AFBA182625E1B29FF44A0FC
                                                                                                                                                                                                                                  SHA-512:E1DAD44026CC9B74A02CBA6D13CD4F3ACE7D293F3257CD9C5D6989D0F6E784895E2993A4FF393867A1A83F85BA0D010B7B04045C9F911B52C546AB1218573297
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3D..]...]...].......].......].......].......].......]...\..].......].......].......].Rich..].........................PE..d......e.........." .....6...........;...............................................C....@..........................................l..f...hd..d....................h...*..........`R...............................................P..0............................text....4.......6.................. ..`.rdata..V....P.......:..............@..@.data...p....p.......X..............@....pdata...............\..............@..@.rsrc................b..............@..@.reloc...............f..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LHEH1.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):618
                                                                                                                                                                                                                                  Entropy (8bit):5.074512409717888
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4B8516B28CA0E2574152EE969F7FA1B1
                                                                                                                                                                                                                                  SHA1:FF8EA55DFAEBB5D0E1A119EC81AEB46E59376AB5
                                                                                                                                                                                                                                  SHA-256:BF2B8BC4398B677FF5FC9B208A97CEA90A14D90A6417A48397642BEF2F06A111
                                                                                                                                                                                                                                  SHA-512:92F7CBFEEAB7147D7725C1B19966D690EAB2942F11B6F97B8ABE87255758D1A4DC0CE95D93E9BC3D27CA6ABF3307B7B4224FB184C7DB7D35EB2C8C9FF8DB4919
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version='1.0' encoding='UTF-8' standalone='yes'?>..<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level='asInvoker' uiAccess='false' />.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.VC90.CRT' version='9.0.21022.8' processorArchitecture='amd64' publicKeyToken='1fc8b3b9a1e18e3b' />.. </dependentAssembly>.. </dependency>..</assembly>..

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LK099.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1679864
                                                                                                                                                                                                                                  Entropy (8bit):6.033515202200982
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:52BBD0E905E886413A9E6FBDDE8612D8
                                                                                                                                                                                                                                  SHA1:8CF55A4E9B3D73611AB87800B0EEEDCB3427C7A0
                                                                                                                                                                                                                                  SHA-256:05EDBE012DAC7DE6CF398AF14DD6007DD83B63A3E4F930972B12A1EBD75C0D41
                                                                                                                                                                                                                                  SHA-512:6D541026785008DCFAA962C242928AF2206AFE6ED8802E30BA881A583E1F63E6744FE50D3D5A4E2F19AEA81E908EC9A9E13F7070AD5207843553F3F231A704CC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@.......p,....p........>...P.;...........)....p............8.....'.7.....?.....9.....<...Rich..........................PE..d....K1G.........." ...........................x....................................H.....@..........................................g../a..(/..x...............83...~...#...p..@s...'..................................................x...@........................text............................... ..`.rdata..............................@..@.data... ........b..................@....pdata..83.......4..................@..@.rsrc................H..............@..@.reloc..L....p......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LKUFG.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):3766272
                                                                                                                                                                                                                                  Entropy (8bit):6.325892695923709
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5E7EF26A408A82E57AEC160534A7D58E
                                                                                                                                                                                                                                  SHA1:719C7A5B6B9F7C9819CFC1A0BF87C87EA74BE0B6
                                                                                                                                                                                                                                  SHA-256:FEDEDD497F3B7F9C9AD6C5F037AA4AD6A65D335CD4AF4CA8F64C445F9C77ACE2
                                                                                                                                                                                                                                  SHA-512:379BCB899CFE602745AF57764E4D98CB87D6913A616A560ACD72B91AE30F48AB162F43B58B17AB8D195407797016F9B1C5A4CE9EE5732B266105DF3D0BB3364C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Tq.CTq.CTq.C].@CPq.C...B@q.C...B\q.C...BVq.C...BPq.C1..BVq.C...BWq.CTq.Csp.C...BUq.C...BUq.C..,CUq.C...BUq.CRichTq.C................PE..d....h@`.........." .........."...............................................9...........`......................................... ....y....5......p9......@8..*............9..9..@...T...............................................@............................text.............................. ..`.rdata..............................@..@.data........`6......@6.............@....pdata...*...@8..,....8.............@..@.rsrc........p9......<9.............@..@.reloc...9....9..:...>9.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LMB1G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):584712
                                                                                                                                                                                                                                  Entropy (8bit):5.92885898793046
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:302D000CC37975044AF5BE4AB5EF1265
                                                                                                                                                                                                                                  SHA1:F85BDF9753CC26C623C001688D4BC8B9872F39D7
                                                                                                                                                                                                                                  SHA-256:620016C4FAF8E3922A6298B72FC967E5AD7E154856135C0FC60967A1DF7D4597
                                                                                                                                                                                                                                  SHA-512:478E97D87AD0D463B84970E112C268A8EB82F3A35C32E26585ADD4FCF03445E2A7DFD51FFD67E97E2B4C46D49E1C9799761686EFDC8365136C0F57959CF7C06E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PXx..9...9...9...v...9...A...9...A...9...A..Z9...A...9...9...9...A...9...A...9...A...9..Rich.9..................PE..d...f..e.........." .....x...F............................................... .......q....@..........................................)..........d................m.......*..........@................................................................................text....w.......x.................. ..`.rdata..6............|..............@..@.data...._...0...,..................@....pdata...m.......n...D..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LOG3L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):27656
                                                                                                                                                                                                                                  Entropy (8bit):6.528549691566617
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2E194298D37850AEF5DBC4191C5B510E
                                                                                                                                                                                                                                  SHA1:C225834F9F687377896090F47C5CB96EACF7E1DF
                                                                                                                                                                                                                                  SHA-256:85CCF6172DC2FAA0AE5FDDC601F4AE005C7E20F9BC21CBE56E930A20980BBF49
                                                                                                                                                                                                                                  SHA-512:5F92F43B74069C1C61DBFBE330FA294C4C98C8F535A6408723E6E415A345870C79B29BE2CAF631B1EF068FEF88B06F5DDF4ADC1EC0E43D3B8ED1368A15E67EEF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z`.Q>...>...>....NZ.?...7yY.?...7yO.5...7yH.;...7y_.7...>...m...7yF.8...7y^.?...7y].?...Rich>...................PE..d...-..e.........." .........$......D"..............................................\F....@.........................................pG..X...`?..P....p.......`..X....B...*......0...02...............................................0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata..X....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..~............@..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LQOGV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12816
                                                                                                                                                                                                                                  Entropy (8bit):6.590202979931445
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:08F8E94021B233848DBC1624CB17BB7A
                                                                                                                                                                                                                                  SHA1:8BDE9C791550226A6E139D86279D22D12054437B
                                                                                                                                                                                                                                  SHA-256:7ECBC9B895AD5A70CCC45E85D3EE401AE0517B71040354351B63D00814D5428A
                                                                                                                                                                                                                                  SHA-512:C8ED343189F6F0FBF89B060FF62053BBD17540D4AA7358B355448C57F6D18F988673806C3E4D103C47A9B09CBAAF0829EFC1C6D779F5B563E9BA326C5413B7F5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...h{............" .........................................................0......@I....`.........................................0................ ..................."..............T............................................................................rdata..F...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-LVLR9.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):25608
                                                                                                                                                                                                                                  Entropy (8bit):6.698652168758156
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3BE7237B0BE706535B1D36155590B5C9
                                                                                                                                                                                                                                  SHA1:C837228D811B2EA1302EBAA9B5A80DF5E8247518
                                                                                                                                                                                                                                  SHA-256:A9D117BC4A8428610905ED102AC3E63C19B3B569E98DE24884E6197922D46E8E
                                                                                                                                                                                                                                  SHA-512:B8C83CA17021778BF1D507FB9D5379537AACFD76A8A3D3DDDA75FCCAA8EA7D7F6B95BBDC04C16BE5BCF8614808351ED9DB72618E9A001C5682FAEC7DE2DF37EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.:..:..:...u..:..B..:..B..:..B..:..B..:..:..:..B..:..B..:..B..:..Rich.:..................PE..d...a..e.........." .................$....................................................@..........................................;...... 6..<....`.......P.......:...*...p..(....1...............................................0..h............................text...!........................... ..`.rdata.......0......."..............@..@.data........@......................@....pdata.......P.......0..............@..@.rsrc........`.......4..............@..@.reloc..F....p.......8..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-M1F59.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):132104
                                                                                                                                                                                                                                  Entropy (8bit):6.201671003807576
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9598A39BF9C11ECE1844C558E9B9ACAB
                                                                                                                                                                                                                                  SHA1:9580CB6F1783BF8661027FA1027D8FB843AFF4CA
                                                                                                                                                                                                                                  SHA-256:475BE681202CCDF07674053584A093C67E0808DA8EDE42E746784524B10811B6
                                                                                                                                                                                                                                  SHA-512:A04B014460375DDEE64A105BA281BEA9ECD42E9BB325937D2EFDADF7EDB43504EA7895F3F5AF39143F99904CC6DD59BFBE2E22B538EE09C6B36DDABEDB0AFCDC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.A.../.../.../.....'./.....z./......./......./.....z./......./......./......./......./.Rich../.................PE..d...?..e.........." .....2...................................................@............@.........................................p...........P.... ...................*...0.......................................................P...............................text...*1.......2.................. ..`.rdata...f...P...h...6..............@..@.data....9..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-M6ABI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):634880
                                                                                                                                                                                                                                  Entropy (8bit):6.532356081276819
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7319BB10FA1F86E49E3DCF4136F6C957
                                                                                                                                                                                                                                  SHA1:3EEA5EE8BAFB2B9975B236C5C5655DF6F4B42AA1
                                                                                                                                                                                                                                  SHA-256:60DE43AB267FD41C9804369B569139ADD30ED4E295C425F44FC04D3FCC95FCA2
                                                                                                                                                                                                                                  SHA-512:B4355548167052C8F520D5B36FCF35FD0C798E36E85E1580B730C9A58D11C36563E71ECAC2431584C14858610BEF5BD99D52A4596587673B675528F91CEA0AD7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.H..............b.5.............d.......r......c.......u.......e.......`.....Rich....................PE..d.....[J.........." .........,.......%........ju....................................2F....@.............................................j..D................p...\......................8............................................................................text............................... ..`.rdata..pj.......l..................@..@.data....V.......N..................@....pdata...\...p...^...H..............@..@.rsrc...............................@..@.reloc..............................@..B..[J....+.[J......[J......[J......[J@.....[Ja.....[J......[J......[J......[J....+.[J......[J......[J6.....[J_.....[J......[J......[J......[J....+.[J......[J....+.[J......[JA.....[Jc...+.[J......[J......[J....+.[J............KERNELBASE.dll.ntdll.dll.API-MS-Win-Core

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-MSQHD.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12296
                                                                                                                                                                                                                                  Entropy (8bit):6.600993739439923
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CD80166720668870FE271DB3A633F897
                                                                                                                                                                                                                                  SHA1:8A7091BACBF71CDBEBF2AC67CE68119833DB6B5D
                                                                                                                                                                                                                                  SHA-256:3DE73E2ED94F3D19531583F2C623FAC6BCE469A2DAFB36861A417055639DFCEE
                                                                                                                                                                                                                                  SHA-512:90A007C2D0132DE5835EDA3D5E89B6C97587217FFB0D0D7D24668BBE8872B1A98DB1C4D13ECECE03D042FAA997628BD73C60ABEBEAC771F1B07CF3FEA3CB55AB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0...........`.........................................`................ ..................."..............T............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-N3PHL.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (502), with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):855
                                                                                                                                                                                                                                  Entropy (8bit):5.355151955685235
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6BE3CB1A6E8FBEF7504E7925BCE90AE9
                                                                                                                                                                                                                                  SHA1:3420AA02C3FC68110455106E01845EB54FA39174
                                                                                                                                                                                                                                  SHA-256:08A557759E3D9CCCD4F6AF972A16474C05AF4E57A24C6CD773184CC0C9E0CDB0
                                                                                                                                                                                                                                  SHA-512:6639D9B902B33200795DFC84655724EE3FEF705AC5427A8EDD6CF6EBA07AAFC250A0C71ED863BFBF320E6FFE6AAFEB6EA37777E92789FD183F933C9E8C804638
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.ATL" version="9.0.21022.8" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="ATL90.dll" hashalg="SHA1" hash="a7f04daa50103e7ef31772e2978fe96ea1a97cda"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>9l843dT07F6g6i/gaWhAcsuGN6Y=</dsig:DigestValue></asmv2:hash></file>..</assembly>

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NOOCH.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12304
                                                                                                                                                                                                                                  Entropy (8bit):6.602619525772672
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E2686222CF81F2ADE726D5B7D61717F4
                                                                                                                                                                                                                                  SHA1:8ABAF7CCC964A49A0A49D3A2887FFAC7A3DDB64A
                                                                                                                                                                                                                                  SHA-256:58B2B1272AF9351306356A097499390852EBA5C429A148283DDC80117980C13A
                                                                                                                                                                                                                                  SHA-512:DAF4149ED1FF432970B8FAEDB3120DF24E9BA424B0D0668A5BBE04BFC0F3390DF718328FD7665F3DFBBA0FDA037032F5222CA6947B4879DA544B1965696506E0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...g P..........." .........................................................0.......w....`.........................................0..."............ ..................."..............T............................................................................rdata..R...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NP1QC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):5820416
                                                                                                                                                                                                                                  Entropy (8bit):6.095757336023101
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:77512692939D0D77217FC17C835D9CC5
                                                                                                                                                                                                                                  SHA1:6611465EC758C9D2B773FDEC96CDD04DE8E2992A
                                                                                                                                                                                                                                  SHA-256:ED6AF85F13D62F30C96B98376297CA6BDB5227A90DB9CD8B95E1D47BF89EE737
                                                                                                                                                                                                                                  SHA-512:015381BCAF5C7D4935A43D6104B2A25B8B412870411C981D960A719CD9ADE40B4DBA763C50DDD48565035AB07C619454BA9167CB1D0008C03C2A980CA54FCB17
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1Kl.u*..u*..u*..|R..w*..|R..w*..|R..w*..R.y.|*..u*...*..u*..V*..|R...)..|R..t*..kx..t*..|R..t*..Richu*..................PE..d.....^e.........." ......@..........(?......................................0Y......UY...............................................Q...... X.x....@X.L....@U.8............PX.......@..............................................(X.h............................text.....@.......@................. ..`.rdata........@.......@.............@..@.data...0.....T..V....T.............@....pdata.......@U.......T.............@..@.idata..=.... X.......W.............@....rsrc...L....@X.......W.............@..@.reloc..~....PX.......W.............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NUM9I.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1264136
                                                                                                                                                                                                                                  Entropy (8bit):6.146295899181699
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DC610E241FCF57FBFD440AE6832EA49C
                                                                                                                                                                                                                                  SHA1:413F72AF1CF65C2E38449884961C822D689D9C73
                                                                                                                                                                                                                                  SHA-256:93E2C110214D2FA9983DE735857FEBF7EE49DBD5507076150365D9EB0703EC22
                                                                                                                                                                                                                                  SHA-512:CDB242F49EA358DC18EA9844AC38C488324994EB7F7BD5E37FAF2BEAF2CD2116B3F54369BB77A0BDFD42471E37DF1EA831118BA24C618FAC4895C5A7337CB2B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^ZB..;,..;,..;,.t...;,..C...;,..C...;,..C...;,..C...;,..;-.;,..C..";,..C...;,..i...;,..C...;,.Rich.;,.................PE..d...M..e.........." .........................................................p......%.....@..........................................J.......0..x....@..........d.... ...*...P..\....5...............................................0..0............................text...v........................... ..`.rdata...1...0...2..."..............@..@.data....5...p... ...T..............@....pdata..d............t..............@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-NUPBA.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):984448
                                                                                                                                                                                                                                  Entropy (8bit):6.648126757310304
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2381E189321EAD521FF71E72D08A6B17
                                                                                                                                                                                                                                  SHA1:0DB7FEA07B4BC14F0F9D71ECFA6DDF3097229875
                                                                                                                                                                                                                                  SHA-256:4918F2E631EF1AE34C7863FA4F3BD7663B2FDF0FA160C0DE507ED343484AC806
                                                                                                                                                                                                                                  SHA-512:2D51D1DE627DEB852D5CE48315654DFB34115EA9F546F640BB2304CD763D4576EADFF5CD7FD184A9B17BAC8BF37309A0409034D6303662EDFA1A6DB69366B9E5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&.a.&.a.&.a./.....a.&.`..a..6..'.a.l..'.a.l....a.l..p.a.l....a.l..j.a.l..'.a.l..'.a.Rich&.a.........................PE..d......U.........." .........N......`........................................ .......^....`A........................................p+.......................P..p........C.............8...........................@...................H............................text............................... ..`.rdata...u.......v..................@..@.data...."... ......................@....pdata..p....P......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-O2UCC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):349192
                                                                                                                                                                                                                                  Entropy (8bit):6.213510170545783
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E2738605A445A8C4239C6AAA18FF8908
                                                                                                                                                                                                                                  SHA1:B070124F8D0C55E036B984AB96BAA863FE6FB9AC
                                                                                                                                                                                                                                  SHA-256:7F390D921DD952DABA9CC3DF41D00302C77F89089D250C82CFEB0D68D95406CD
                                                                                                                                                                                                                                  SHA-512:A5F8512C51CE4691F4EC7C653FA583273AB21785E20E27E671044AF169BF2EA4CE42479C342A3FC17341FF3FE435256AD08CA4EE4FD9F66863090D42CD263221
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.. )o.s)o.s)o.s. Js(o.s .Is+o.s ._s?o.s .Xs"o.s .Os"o.s)o.s.o.s .Vs3o.s .Ns(o.s .Ms(o.sRich)o.s........................PE..d......e.........." .........................................................`.......V....@......................................... ...g...d...x....@...............*...*...P.......................................................................................text............................... ..`.rdata...5.......6..................@..@.data...p...........................@....pdata...........0..................@..@.rsrc........@....... ..............@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ODCA3.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):91656
                                                                                                                                                                                                                                  Entropy (8bit):6.499332952623373
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8E966E640F56AE55AE15A54EA047C99B
                                                                                                                                                                                                                                  SHA1:CF012A1A0F5D2C60ADFC04DCD19E27695413E63E
                                                                                                                                                                                                                                  SHA-256:C7D82D6557DB7AE59636630A580667C15BF17C8DFDBB1A6016091178D8AD07B4
                                                                                                                                                                                                                                  SHA-512:595BF1D96B6486A7C00C44D5E1EDBCB84DE44FB3466C1E588240883B40122667164EFE6627AE3A633C0F26BDF3F4E3C6C9AD3D7DB19B0D46B0753D3947D2B9D2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1\.qu=a"u=a"u=a"|E."P=a"|E." =a"|E."|=a"|E."r=a"u=`".=a"|E."p=a"|E."t=a"|E."t=a"Richu=a"........PE..d...e..e.........." .........b.......0..............................................D.....@..........................................%..|...,...P....p.......`.......<...*...........................................................................................text............................... ..`.rdata..\8.......:..................@..@.data...P&...0......................@....pdata.......`.......*..............@..@.rsrc........p.......6..............@..@.reloc...............8..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OFMNI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11784
                                                                                                                                                                                                                                  Entropy (8bit):6.643455137102238
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D0842AC13C33E2287D8ADFB16BC83E7A
                                                                                                                                                                                                                                  SHA1:68CFD86A437BD755C2F06E59FD2BA87026D9BEC1
                                                                                                                                                                                                                                  SHA-256:79F0CCFEC37C99A53FA333C95ADF94420765366D040EEA78A76C545C89708FF6
                                                                                                                                                                                                                                  SHA-512:88A5E680ED5E42452D0B7F638327BC38E88AF835ADA391A11C44C43FAEBEE040D9D30227DBA12231ED4FFA0C8FD3CB461F5A682D48E40A9C29EC410F069CA346
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0......o.....`.........................................`...L............ ..................."..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OG99R.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Non-ISO extended-ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):13009
                                                                                                                                                                                                                                  Entropy (8bit):5.03628966454849
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F8522E8F3A35F684B4C67735D7B29F42
                                                                                                                                                                                                                                  SHA1:D06E1A6D3A50EBED02E0D73DB7E27356C3CCC1A5
                                                                                                                                                                                                                                  SHA-256:D9AD6A19DF842E72502E7109DE42EA47CDF2389E7B6C628F465A42FB6DB04E73
                                                                                                                                                                                                                                  SHA-512:73CBC3B1B6BF62F5E7AECA794D5AF6C375179B8C6D92EC42CAB6DDDE4BDE6F9BEEFA2FFEE5CAB1EE1095A44121F81DA6DBDF9E6A96F301523A8214156CD00D01
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:'******************************************************************************..'Microsoft Confidential. ?2002-2003 Microsoft Corporation. All rights reserved...'..' This file may contain preliminary information or inaccuracies, ..' and may not correctly represent any associated Microsoft ..' Product as commercially released. All Materials are provided entirely ..' .AS IS.?To the extent permitted by law, MICROSOFT MAKES NO ..' WARRANTY OF ANY KIND, DISCLAIMS ALL EXPRESS, IMPLIED AND STATUTORY ..' WARRANTIES, AND ASSUMES NO LIABILITY TO YOU FOR ANY DAMAGES OF ..' ANY TYPE IN CONNECTION WITH THESE MATERIALS OR ANY INTELLECTUAL PROPERTY IN THEM. ..'******************************************************************************....Option Explicit....Wscript.Echo "" ..Wscript.Echo "REGISTER_APP.VBS version 1.6 for Windows Server 2008"..Wscript.Echo "Copyright (C) Microsoft Corporation 2002-2003. All rights reserved."..Wscript.Echo "" ......'**************************************************

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OGD22.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):21024
                                                                                                                                                                                                                                  Entropy (8bit):6.9917958216689815
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7A55E51D07E1F15221EB11479ADBC53F
                                                                                                                                                                                                                                  SHA1:8D8E2BEFF4DFA78372201B26A67B9DC4B116290F
                                                                                                                                                                                                                                  SHA-256:F901B0BC8C00B3AFC80E151E6F54B18F7672F932602C304FBFEEDD5AA3AD63C8
                                                                                                                                                                                                                                  SHA-512:E89C0E45014ABDAF7548DE0352949C4AD496D97CAD2F9E2F6C83A90F853B7B71354B9ABBB957EFF89076DF79BDC9CC1C431B6F35875550BFB4198C3A68124197
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...uQ'..........." .........................................................0.......4....`.........................................`................ .................. D..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-OGLO4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):179704
                                                                                                                                                                                                                                  Entropy (8bit):6.1878876402404
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:55241DDC9A3C9DD0EBECAF78D4A767D7
                                                                                                                                                                                                                                  SHA1:F65F38DDD4F4EC5EA0EA2FE069684072CB8637A6
                                                                                                                                                                                                                                  SHA-256:9645F00C8CDBD96EC61A99443CE4EAF178CFCC164848F847B70472C377BE4FB9
                                                                                                                                                                                                                                  SHA-512:04F44715858280CA3E95605B90DBAF4BAD20712CC03243762D2372900C4FF7263BAF45E98469BC3E493B2B047FD0D04B371C5070C6DC70018AA422F4626D9EB9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.j.:...:...:....~i.8...$.K...$.3....~..9...:...>...$.....$.;...$.;...$.;...Rich:...........PE..d...'>1G.........." ........."......p.........Yy.........................................@.........................................PB......x7..(........"...............#.............................................................H....%.......................text...g........................... ..`.rdata.. ...........................@..@.data....?...P.......4..............@....pdata...............R..............@..@.rsrc....".......$...h..............@..@.reloc..t...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-ONQ9N.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12304
                                                                                                                                                                                                                                  Entropy (8bit):6.7272309946707844
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F98687F24C22ED699DBC3721CDA79044
                                                                                                                                                                                                                                  SHA1:67F97F2DC22A76C533435E9F3EED4D43C8265D90
                                                                                                                                                                                                                                  SHA-256:EA02309A2DE376DC9321E2A1154ABFE39170762AC24E5925D5FB8F3E726D723F
                                                                                                                                                                                                                                  SHA-512:64C0CB361328F4D2C4A6B15B4E345D6F3C83C195B2AC879712F443E722C6694A5A16FBDCA2B7CF287081FFE093EE0D01573B22D3241DE03CFA195BBBD6D3EB58
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0.......-....`.........................................`...x............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PCQL4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):15376
                                                                                                                                                                                                                                  Entropy (8bit):6.562006648102604
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F753699EA5569C33BF9ABD2D766445C1
                                                                                                                                                                                                                                  SHA1:43BA6C336CDBED435A73137201F7EC1C8A9E25B2
                                                                                                                                                                                                                                  SHA-256:EEB1780941F9E74C8F7E176D42B4DF1AE8AE27BDA5C6C2F569EC64200D3F1C88
                                                                                                                                                                                                                                  SHA-512:5DCFD22BF1D504157390B9B90D45E61D3407DBB6DCB65B1B363C06C027A8CF74FA1533DC479B422EECDA070032B9AF7B24893372E0D2B69D4E6F0D6C20A1CF18
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................@.......W....`.........................................`................0..................."..............T............................................................................rdata..(...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PEA4S.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):232483
                                                                                                                                                                                                                                  Entropy (8bit):6.047559200380935
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:57A37262A5184FE1809F03D4F6B59CCC
                                                                                                                                                                                                                                  SHA1:EC960FFFD7ACD998577E906ED99D1ED6EA03A5C2
                                                                                                                                                                                                                                  SHA-256:CE34910B43D5E4285AECDA0E4F64A1BA06C5D53E484F0B68D219C8D8473332AB
                                                                                                                                                                                                                                  SHA-512:1435BF5E133B2A16B0F1E9DE37AA1215C67AC8A8D394AFB0E4DD4F74B54E70254DEFD88D7FB48D2702B4FCD9E6944FEDBB8D9B9C7AA6EC814746AD81A4725C07
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....*.R....v.....& ................ ..........c...................................."......... .................................................(.......D.......................................................(....................................................text............................... .P`.data........ ......................@.`..rdata..0h...0...j..................@.`@.bss....`.............................`..edata..............................@.0@.idata..(...........................@.0..CRT....X...........................@.@..tls....H...........................@.`..rsrc...D...........................@.0..reloc..............................@.0B/4......`...........................@.PB/19.....w.... ......................@..B/35.....T....0......................@..B/51..........@......................@..B/63.....+....`......................@..B/77.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PIE86.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11792
                                                                                                                                                                                                                                  Entropy (8bit):6.667583098576836
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A62B72F523792F2844794AE3B376FC86
                                                                                                                                                                                                                                  SHA1:16377BEB178E4E3D898C3CD1A39147FCD862D661
                                                                                                                                                                                                                                  SHA-256:B6AA2F51B31C16D7C4474F6C42F16761C4C898A242CF91E93BEDD82A41F7CA1B
                                                                                                                                                                                                                                  SHA-512:99A93921C91FF5F61D367FE244EFC0D53BA5A495B8D8C1B648CD52CEC772FD61DC734EF423D060C7D34E2FD3B6408FA3CA8154B0960A10F47962414559586DC6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...*............." .........................................................0.......,....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-PU249.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1078280
                                                                                                                                                                                                                                  Entropy (8bit):5.716998432673192
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:42DA2BE4B3D69401E9401FBEEF156E75
                                                                                                                                                                                                                                  SHA1:DF5C1735E2A081F8206B862219E69F879B620A76
                                                                                                                                                                                                                                  SHA-256:45DB1ADCCD9279BDEE841FB17FC7709C4F67BA32CD4DC5A5FB42B50CA9F0FA4B
                                                                                                                                                                                                                                  SHA-512:80DCB0739C6460FA4ED3358814406A5178E492FFB732EA33B7D794B76634F67DD38A8834FB1E28EF3502484F74E27B48B0063A55BE41E46DA31E399B1AE2A287
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-.`.i..Yi..Yi..Y..Yh..Y`..Yh..Y`..Ye..Y`..Yn..Y`..Yn..Yi..Y...Y`..Ym..Y`..Yh..Y`..Yh..YRichi..Y................PE..d...n..e.........." .....f...........k...................................................@..........................................!..L...0...P....p..........Dj...J...*.......... ................................................................................text...8d.......f.................. ..`.rdata..............j..............@..@.data...@....0......................@....pdata..Dj.......l..................@..@.rsrc........p.......0..............@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-Q3QDO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):18472
                                                                                                                                                                                                                                  Entropy (8bit):6.286011465843997
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5C1ECCF8F088C294E4FF4ADA4E559567
                                                                                                                                                                                                                                  SHA1:BB8FC158E23445BC0DEF4BCBD4F9A622B340BB6E
                                                                                                                                                                                                                                  SHA-256:F632698BBA686C32D5DE71D42EF2080D793B52C7A2EC409C8440D0AAA315E9AC
                                                                                                                                                                                                                                  SHA-512:02CB60E4B843C4622D410ECFE48285B983A1C750242A6E894EC6556FDC35C5076437F176E7D4DADF5BBA819CE892B426F2717503C2A09B7DC1DC5FF6D3D830CC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......e.........." ........."...............................................@............`.........................................0................0...............&..("..............T............................................................................rdata..............................@..@.rsrc........0......."..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-Q3TE4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):93696
                                                                                                                                                                                                                                  Entropy (8bit):4.531608537284783
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:129CBCE34538631814B03EFE948DD98E
                                                                                                                                                                                                                                  SHA1:61B0E9DAB9C6D31F2CB1827C1361EFCFC5B2C748
                                                                                                                                                                                                                                  SHA-256:5E90538A7CD665D49A676A21A660A1695C514D004CE2584169138FB802816335
                                                                                                                                                                                                                                  SHA-512:DB9F05D20D5327CE650B0497174CB3A5FA29BF27819569A8FAE330F1DE6E1F74ADE3B1197FB283BBED9F0110FF1558A864C530EFC07444009A220A181F8C5BE4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............mE.mE.mE..lD.mE..hD.mE..iD.mE..nD.mE..lD.mEj.lD.mE.lE..mEj.iD.mEj.mD.mEj.E.mEj.oD.mERich.mE........................PE..d.....>`.........." ......................................................................`.........................................@'..........x.......<....p..........................8...........................@................................................text...r........................... ..`.rdata..@A.......B..................@..@.data...Q&...@... ...$..............@....pdata.......p.......D..............@..@.idata...............P..............@..@.00cfg...............b..............@..@.rsrc...<............d..............@..@.reloc...............j..............@..B........................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-QAD3U.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11792
                                                                                                                                                                                                                                  Entropy (8bit):6.621488233135512
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:ABC63F8B93596B6DDBBF5FE1FF97913E
                                                                                                                                                                                                                                  SHA1:CC5BAD92ACE5DCC684E0044B10DB2C5C950162C1
                                                                                                                                                                                                                                  SHA-256:5DCD30945AF1FF0FE4D229CB37A2FAF9461F5DAEEAF683D375379C1D4BBF00E4
                                                                                                                                                                                                                                  SHA-512:8266D6C18833342CD766F85A8606FC874F6F48F759D496EF70A2D27AC0158783E19EE9AF30F43D4F7370BAF36F39E21FC9F6058FDA055ACA7AC025AAA4AAA3BE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...T............." .........................................................0............`.........................................`................ ..................."..............T............................................................................rdata..0...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-QT4GM.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):9749
                                                                                                                                                                                                                                  Entropy (8bit):7.369630321791618
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:378E43013CEAAC08368673B7D9FD97E6
                                                                                                                                                                                                                                  SHA1:853D0BBB2A874A9B97609DAB2C5276FA4FAC4A5C
                                                                                                                                                                                                                                  SHA-256:81C6FB67356AB72AB5375B7179A5B0C0467D524890194360783CC4971FEE6142
                                                                                                                                                                                                                                  SHA-512:186D425FA81F1A99B379EFFDFFB1E41FDDA7E40F26C5BF25BC43F266F6F6B33052EA31725AF25EE6E8D9005B677BE388038747955F755669C8378802A3683421
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:0.&...*.H........&.0.%....1.0...+......0..u..+.....7.....f0..b0...+.....7.....}NEp.~[A.tA......071107060506Z0...+.....7.....0...0....R7.C.F.6.8.5.9.A.E.9.6.9.3.E.A.D.1.2.8.A.4.0.F.7.F.3.6.B.2.E.B.A.F.9.C.E.9.2.3.F...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........|....i>...@..k....?0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.9.0...C.R.T...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........|....i>...@..k....?0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0..............<<...>.c..@0...*.H........0p1+0)..U..."Copyright (c) 1997 Microsoft Corp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority0...970110070000Z..201231070000Z0p1+0)..U..."Copyright (c) 1997 Microsoft Corp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority0.."0...*.H........

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-R82R0.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1805112
                                                                                                                                                                                                                                  Entropy (8bit):6.082420983698557
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8E901505FE21850AD1E82A377F93CB98
                                                                                                                                                                                                                                  SHA1:3641745F187F0F435CE39146E18ECB57217D8A88
                                                                                                                                                                                                                                  SHA-256:84F26F3825AB76F951F7F6E4A55E00BE2E0C8DF0C05C37B61EB6DA43F382F868
                                                                                                                                                                                                                                  SHA-512:49E4977FAE275AE4E96C9887B07B7E745EBDE6FCE8E820C36CCE2F5D259461631DCFB32D7129448A9396DEA7B23E528D9CB6A21F46A5343B32843253C5B594C3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......H...H...H..0H2..H...H...Hr.^H...Hr.I...Hr.I1..Hr.IU..Hr.I|..Hr.I...Hr.\H...Hr.I...HRich...H................PE..d...E..p.........." ......................................................................`A........................................ j.......E..................@....N..8=.......... ...T...............................................@............................text.............................. ..`.rdata..B...........................@..@.data....,...`.......F..............@....pdata..@............X..............@..@.rsrc................<..............@..@.reloc...............B..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-R8V0K.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):666120
                                                                                                                                                                                                                                  Entropy (8bit):5.747277338735834
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7A025842F50D9338AD90F256DF2E145E
                                                                                                                                                                                                                                  SHA1:EFF399FC0F79C9D9C5D880F1A199E5A652EA7496
                                                                                                                                                                                                                                  SHA-256:810BF0BB4E7887C69C862D2AF3C6EC55594A7BFFF73952C4DF9BDECDE0822882
                                                                                                                                                                                                                                  SHA-512:EAAA9241683D286D7CC7D539AFC771808A08A76BB5D997752DD502AEA5D268B5753C0B0F9C5C8E605A9BB30D2CF7E562B0A97901FD33555E6BB58E15A32E79F5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.g.f.g.f.g.o..l.g.o....g.o...`.g..-..e.g.f.f...g.o../.g.x..g.g.o...g.g.Richf.g.................PE..d......e..........#......`.....................@.............................P.............................................................. k..d....@..........Xk.......*..........pt...............................................p...............................text...._.......`.................. ..`.rdata.......p.......d..............@..@.data....F....... ...l..............@....pdata..Xk.......l..................@..@.rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RFQVO.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1169408
                                                                                                                                                                                                                                  Entropy (8bit):6.275807825044345
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BBDFBF35C7915B7DCB9D1AF5957330EA
                                                                                                                                                                                                                                  SHA1:60BB7DD353AAF351853B76BEEAB13C70043CE6CA
                                                                                                                                                                                                                                  SHA-256:0874F0301AF35761203EC87BFA99B7CC1C8A6F132ADF3DADAB4B6ED81B0CEB02
                                                                                                                                                                                                                                  SHA-512:E4ADAFC5F215A2DC318DF7FB47B7C393B524E92696FD30EE6E93D7B8B0498E2BDEE553D85BB3B213413FCEBDB16DDD49536B42D1CF673C31DD04EF8B509B1FF8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c./d'.A7'.A7'.A7...75.A7u.@6#.A7u.D6>.A7u.E6/.A7u.B6$.A7..@6#.A7B.@66.A7'.@7..A7..D6..A7..A6&.A7...7&.A7..C6&.A7Rich'.A7........PE..d...hg@`.........." .....>...........|....................................................`.............................................$...$................`.........................T...................p...(...p................P..`............................text....<.......>.................. ..`.rdata..|....P.......B..............@..@.data....Z.......P..................@....pdata......`.......8..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RJPQM.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):135448
                                                                                                                                                                                                                                  Entropy (8bit):6.071708748397082
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4D56968F9E25CDDAE77A5DFD39E5D004
                                                                                                                                                                                                                                  SHA1:75A7370665399CE512F4DBF796A74B927C20D060
                                                                                                                                                                                                                                  SHA-256:2613815661FBFE0045DA144B3EBD76B7C8D2AECAF182A046D76509DA1ADB98A0
                                                                                                                                                                                                                                  SHA-512:C2E67C335DB9A416F116956B4C0D740E38A01CF7243B86603A120F691C150F90F37652972416A6C86C2EDDCD0DABD1E23B260697C1B55B19F7871AC9F721D128
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.....K...K...Kx.NK...K...K...K.y.J...K.y.J...K.y.J...K.y.J...K.y^K...K.y.J...KRich...K........................PE..d.....0].........." .....v...\.......t....................................... ......O.....`A............................................4.......<........................A......|......T...........................0................................................text....u.......v.................. ..`.rdata..,8.......:...z..............@..@.data... ...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..|...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-RSR84.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):208392
                                                                                                                                                                                                                                  Entropy (8bit):6.222181495620093
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AE7382AAD57FBC3D845A28D2E7050479
                                                                                                                                                                                                                                  SHA1:9FA30D4DA7008A8125F7125B97F4FEA5CE373F38
                                                                                                                                                                                                                                  SHA-256:714F4732C6952B6FA689EBCF0E1446345563A52D7E06EBF9A056F3CD2EA13CAC
                                                                                                                                                                                                                                  SHA-512:DF62CD9FEC7EAEE0C51F4B4C07D6E40A01913D8B95D57664A1EBFAFBFBBB5D182D5C8EF445D7F8905A501BEBE91E5195A9857DE58337535DCBF9C229C6CF08EE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#.5.B.f.B.f.B.f.:Mf.B.f.:Jf.B.f.:\f.B.f.:Zf.B.f.B.f.B.f.:Cf.B.f.:[f.B.f..]f.B.f.:Xf.B.fRich.B.f........PE..d...4..e.........." .................).......................................`............@.........................................`................@..........t".......*...P.......4...............................................0...............................text...4........................... ..`.rdata.......0......................@..@.data..../..........................@....pdata..t".......$..................@..@.rsrc........@......................@..@.reloc..j....P......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-S2JLI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):67080
                                                                                                                                                                                                                                  Entropy (8bit):6.097265997761464
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A132B3CCED8CA34F03A4B9E96DC99047
                                                                                                                                                                                                                                  SHA1:3C490D2D8A7AA577DB5E400E58B7A7176A3EC0A4
                                                                                                                                                                                                                                  SHA-256:17A49075F1A028723C70AE6792020FD20F35DD88ABB24970AA1039AC3934BBA8
                                                                                                                                                                                                                                  SHA-512:B99EC16890E9CA1D0F8EC8ABC4A428A2992BA68A8B24031094BF0D9DE37C9B5BC3F0325612E2682F900039B0E3731FCE8A4D209CF43273A0870C6F4759D6A0EB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j^...0X..0X..0X(D.X..0X.s.X..0X.s.X..0X..1X..0X.s.X..0X.s.X..0X.s.X..0X.Y.X..0X.s.X..0XRich..0X................PE..d......e.........." .....b...v......pa.......................................0......L=....@.........................................P....................................*... ..\...`................................................... ............................text...T`.......b.................. ..`.rdata...E.......F...f..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-S4ATD.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):72200
                                                                                                                                                                                                                                  Entropy (8bit):6.071261951163998
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:687744E0581A685BAC8DF00D547C6CEA
                                                                                                                                                                                                                                  SHA1:C0F078643605D8F5F258B3E4E8E894EC326BE8FB
                                                                                                                                                                                                                                  SHA-256:874E52002140EF7DD2282A522A19321FFA56F3BDC2F24E83A6A289FCE3FDE535
                                                                                                                                                                                                                                  SHA-512:73BD7CF8231392379BFA4E6C65BCD10A6F42B840B1FA3B5B144838BDCEE5C84C311D159AB5776576FD5AB86E9077ED1F67CD36048FD0DAADE8B134C1D616348C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L.."..."..."......."......."......."......."......."...#...".......".......".......".......".Rich..".................PE..d...W..e.........." .........R..............................................0............@.............................................*.......x...............@........*... ..P....................................................................................text...o........................... ..`.rdata...9.......:..................@..@.data...............................@....pdata..@...........................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SB347.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):963744
                                                                                                                                                                                                                                  Entropy (8bit):6.63341775080164
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E2CA271748E872D1A4FD5AC5D8C998B1
                                                                                                                                                                                                                                  SHA1:5020B343F28349DA8C3EA48FB96C0FBAB757BD5C
                                                                                                                                                                                                                                  SHA-256:0D00BF1756A95679715E93DC82B1B31994773D029FBBD4E0E85136EF082B86A9
                                                                                                                                                                                                                                  SHA-512:85D6BCAAF86F400000CF991DA1B8E45E79823628DC11B41D7631AA8EE93E500E7DA6E843EA04EDB44D047519DABEF96DCB641ADC2A7B3FAA5CD01E8A20B1F18E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'SuSu.u_'SuSu.u_'SuSu.u_'SuRich^'Su........PE..d......V.........." .....j...:.......)..............................................+l....`.....................................................(............@...s...v...>......8...p................................2..p............................................text...eh.......j.................. ..`.rdata...9.......:...n..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................`..............@..@.reloc..8............d..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SJ54O.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1055676
                                                                                                                                                                                                                                  Entropy (8bit):7.1816693570035035
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A885D3776B14B6EF7E24D0E04DF69F86
                                                                                                                                                                                                                                  SHA1:5E45FA5E5BF0C982CC122D104AABA82E6BA2D3A1
                                                                                                                                                                                                                                  SHA-256:954B8740A7CBE3728B136D4F36229C599D1F51534137B16E48E3D7FF9C468FDC
                                                                                                                                                                                                                                  SHA-512:ABFB42F440E361453794579C9898DD0D2574A03284993581E098685A0627B0BFC9E073320334452FCE4234B6BC0445619344A735D2BF67272687D6E766EDA11B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....).R.0........& ................ ..........f............................. ......5......... .............................................. .......P.......................`..P............................@..(...................@"...............................text............................... .P`.data...P.... ......................@.`..rdata.......@....... ..............@.`@.bss..................................`..edata..............................@.0@.idata....... ......................@.0..CRT....X....0......................@.@..tls....H....@......................@.`..rsrc........P......................@.0..reloc..P....`......................@.0B/4......`....p......................@.PB/19.....w...........................@..B/35.....T...........................@..B/51.................................@..B/63.....+...........................@..B/77.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SJG3V.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):66056
                                                                                                                                                                                                                                  Entropy (8bit):6.064722748587114
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4578588E724DB7176D7B143A552EB479
                                                                                                                                                                                                                                  SHA1:CB2382333D031CEB722ED940C951DF2796249273
                                                                                                                                                                                                                                  SHA-256:4CD7AEF3711CEC3A9A88B84C99847CD5DE288A3BC9B7D758CADC4919042D4579
                                                                                                                                                                                                                                  SHA-512:DCF0E028D3E37F653A42F0A8E13CDD4BB5CE61753E9E1CCE2DE335544CF502D889A814B449AD70287F695CB9B3CE8DD749CF8D3892A8600834E59880D0BA48A4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?..A^..A^..A^......@^..H&..C^..H&..M^..H&..G^..H&..J^..A^..,^..H&..@^..H&..@^..H&..@^..RichA^..........PE..d......e.........." .........P......$........................................ ......I.....@.....................................................x...............D........*...........................................................................................text............................... ..`.rdata..{8.......:..................@..@.data...............................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SKJ5M.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11784
                                                                                                                                                                                                                                  Entropy (8bit):6.643884463742571
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CE4FA9B6076007756515717B711AF9D4
                                                                                                                                                                                                                                  SHA1:7AE7A19EDC7018696786C5CF793372DE3A7FD836
                                                                                                                                                                                                                                  SHA-256:412334E6F0F829A18EA31A06F380D3810C83292BD0691FBE8588BDFC07DD3A20
                                                                                                                                                                                                                                  SHA-512:62A9987289DAB6227391B9D5D02D3BAA23F2119B4CA59160759C7D7AB9D83016477DCC75DBF4CAC8D64BBD478AA0B53C791E01FFBFE8E1ED565A641BBC3BD668
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...>G.j.........." .........................................................0............`.........................................`...`............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SMLAC.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):14344
                                                                                                                                                                                                                                  Entropy (8bit):6.527146635794406
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:89B1B41BE1FCD4AF04D1D55172C34719
                                                                                                                                                                                                                                  SHA1:E156CFEFD0350C84AD3E08CDC1BD283299CDF6D4
                                                                                                                                                                                                                                  SHA-256:33FDD447A19B761C7017F599DAB6C1EC14AF6AB139F81959E93E85C7A543C5B0
                                                                                                                                                                                                                                  SHA-512:EC3D3026AF951C4B2086E4C9E7741E90F7E64199564BC105F5847B08A70D028054240FCCA09EEE412F10E9681457D7DDBA85C77A8D7ADFE51F2F3323C41B3301
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...j............." .........................................................0............`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-SRLMP.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):613376
                                                                                                                                                                                                                                  Entropy (8bit):5.381273964093852
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D75C0C37F69BAD6E7751EE8A00C732B9
                                                                                                                                                                                                                                  SHA1:23AD0515892C6B239C4946BA14F2D1F073A5CCDF
                                                                                                                                                                                                                                  SHA-256:2E4576186E66DC1A4FAAD0DB884E3FEA9BC796CC6319FA515A69C9EED4FC9163
                                                                                                                                                                                                                                  SHA-512:DE877CD044374B2E38A138998A542F20CAFF6E7454D283B3DB561338FB2CC6C0E289BBDC7A8C445B050CEFA7ACCEE74EC0B5B83646F5737554A8678640CCABCD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./..jA.jA.jA...@.jA...D.jA...E.jA...B.jA...@.jA.j@..jA...E.jA...A.jA.....jA...C.jA.Rich.jA.........................PE..d.....>`.........." ......................................................................`..............................................R...e..d.......<.... ..X/..............p...0P..8...................xS..(...pP...............`...............................text...r........................... ..`.rdata..?........ ..................@..@.data....0.......(..................@....pdata..@5... ...6..................@..@.idata..(....`.......(..............@..@.tls....E............@..............@....00cfg...............D..............@..@.rsrc...<............F..............@..@.reloc..p............L..............@..B........................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T089L.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):733704
                                                                                                                                                                                                                                  Entropy (8bit):6.319731907914807
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8490B842F25CE86CAA2834B14571595D
                                                                                                                                                                                                                                  SHA1:544899CA0A1E1E8F0534EE5DAF047B6BF5895213
                                                                                                                                                                                                                                  SHA-256:E2DD40946E2BEF17BE756FE5B9299AC5EF375E63E3EA1F0EAF79F8415274EB14
                                                                                                                                                                                                                                  SHA-512:C2A0989EA224CA3D7CDA1BD92F8D914E8DEF89117B57E435E16130380EEBAADFCBA1B3D8A920840B607A0482E4936E5F12F60278B16DEB45A81D6AB03EEA4FDD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wsr...!...!...!.n.!...!c..!...!.~. ...!.~. ...!.~. ...!.~. ...!.r. ...!...!...!X.. ...!U.. ...!U.. ...!U..!...!U.. ...!Rich...!................PE..d....>.d.........." .....h...........5.......................................P......O.....`.........................................`... .......|....0...........[.......*...@.. ...P...p............................................................................text....g.......h.................. ..`.rdata..6,...........l..............@..@.data...x...........................@....pdata...[.......\..................@..@.rsrc........0......................@..@.reloc.. ....@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T27CQ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):401928
                                                                                                                                                                                                                                  Entropy (8bit):6.007283381461447
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4F31B22D8DFB414FFEC178239013FC4C
                                                                                                                                                                                                                                  SHA1:8204125A650D145C2298EFD88003C4E2224F92C3
                                                                                                                                                                                                                                  SHA-256:5614D9A35E7F2D17D9F533C6C4BA2E0E63F0A37A22B13B76C2723D056F6D4E31
                                                                                                                                                                                                                                  SHA-512:EB93D63494E547C6C8BAF0BC69AD0AB314E910505DD0941792AC5C7FE79319CE7502C59F8CBED07ECC03BAF4EAB48B7283C94124F5EE425062157E9E6F3C8A44
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i...&o..i....l..i....z.fi....}..i....j..i...i...i....s..i....k..i....h..i..Rich.i..........PE..d...s..e.........." .....\...................................................`............@.............................................j.......<....@..........`E.......*...P.......t...............................................p...............................text...J[.......\.................. ..`.rdata..j....p.......`..............@..@.data....Y.......&...~..............@....pdata..`E.......F..................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-T2UEV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):26632
                                                                                                                                                                                                                                  Entropy (8bit):6.633233455593971
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:73F09203B5C1C6085AF7C8CFB2495B07
                                                                                                                                                                                                                                  SHA1:04ABF232C75FCA2792D282AF9464C1F041161E82
                                                                                                                                                                                                                                  SHA-256:C593C41FA576FC7059208351C818C2874BA9BCE30AA286A2B1C540C605365D08
                                                                                                                                                                                                                                  SHA-512:B019805285276B2B4A845C699A794EB06BA3C6F87EC9D1D65733EA816E69D1C30C5BE75BD92A9660C362BC2BDD863257B7419139591E7814007AE6974BD558CE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.7Pu.Y.u.Y.u.Y....t.Y.|...t.Y.|...~.Y.|...q.Y.|...r.Y.u.X.N.Y.|...q.Y.|...t.Y.|...t.Y.Richu.Y.................PE..d...i..e.........." ......... .......#..............................................l.....@..........................................B..v....;..P....p.......`.......>...*......4... 2...............................................0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.rsrc........p.......8..............@..@.reloc..`............<..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-TVA30.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):94728
                                                                                                                                                                                                                                  Entropy (8bit):6.330167290291365
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:427D87E84D6EE09A576C42EC9827C717
                                                                                                                                                                                                                                  SHA1:918BCAC19E064DA83A8D8C475A0CC66A9AD3F6F1
                                                                                                                                                                                                                                  SHA-256:E95964D1BC928F8C4F389F7B15615F0802885C0D169BCBD0EFA4953B11D215BC
                                                                                                                                                                                                                                  SHA-512:21381C38A6EB80F5D733290D986972707E33DA75D0369C93A4B5C7D25D4E7F09C6D3279A60D2DA4F8952A8DBF61EE823BDFF01C5114F5D8C9053D4ADA0BDCB48
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<haTx...x...x....F..y...qq..z...qq..s...qq..p...qq......x.......qq..u...qq..y...qq..y...Richx...........................PE..d...:..e.........." .........j......H....................................................@..........................................9.......(..P....`.......P.......H...*...p..<....................................................................................text............................... ..`.rdata..,J.......L..................@..@.data...x....@.......*..............@....pdata.......P.......0..............@..@.rsrc........`.......@..............@..@.reloc.......p.......D..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UF2QQ.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):330760
                                                                                                                                                                                                                                  Entropy (8bit):5.775086806001717
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:791F0D379A6D71922EED737F8C3CB735
                                                                                                                                                                                                                                  SHA1:96E5E950FAD290432405403C513871464FC30C33
                                                                                                                                                                                                                                  SHA-256:2A1EBD40AABEC82BDDEB9F403879EBA8CD41E67AF3298958877FD103111B28CD
                                                                                                                                                                                                                                  SHA-512:8C9D3F312752530337C4EE8796330D269348AE95C3DA251C65109FCFBD79A23F187886422B4774867BCA0E55D31D86B2B2954BB893EE39902972475CAFB280AB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%.d.v.d.v.d.v[+bv.d.v..av.d.v..wv.d.v..gv.d.v.d.v.e.v..pv.d.v..~v.d.v..fv.d.v.6`v.d.v..ev.d.vRich.d.v................PE..d......e.........."......b...|......xH.........@.............................0............@.........................................p...i.......................+.......*... .......................................................................................text....`.......b.................. ..`.rdata...:.......<...f..............@..@.data...h...........................@....pdata...+.......,..................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UJ0I8.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):100872
                                                                                                                                                                                                                                  Entropy (8bit):6.427957819730834
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D2267DA601E4759B18BFA5AECCE7A0F6
                                                                                                                                                                                                                                  SHA1:97E7C0B11582DBA79CBA82939172D02AE16D9ED6
                                                                                                                                                                                                                                  SHA-256:327D4F3FA7B633B24D0B4B96B1F12259C4BD332A27980F6C3362CD6CB8AE39D9
                                                                                                                                                                                                                                  SHA-512:FBC121C67BD2D3B93A8727337FB448F11D94958C36C3A238760ACD9B6196DA38F63F918FDF68B0279BEF167EFF94475B6B38C57A6C1B1FE128AF2D6D2B701911
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ro..ro..ro.S=...ro......ro......ro......ro......ro..rn.ro......ro......ro......ro.Rich.ro.................PE..d...m..e.........." .................................................................t....@.........................................P...}.......P....................`...*......P...@................................................................................text...<........................... ..`.rdata...F.......H..................@..@.data....T... ...L..................@....pdata...............J..............@..@.rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UK8GF.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12304
                                                                                                                                                                                                                                  Entropy (8bit):6.61965970021638
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:420323D0E507B86DA548D20B94F3ECAE
                                                                                                                                                                                                                                  SHA1:9F3876284BF986E627ABD7248E86CD1E1B1ACA42
                                                                                                                                                                                                                                  SHA-256:4185280EA58EA63579BDC141BB5263DAA42EAF105B8A81E4C7CCE89DBA331957
                                                                                                                                                                                                                                  SHA-512:AB331A9FAC890E8959218C65B9CF233C8D18573E1DBBB7D798A761131F5FC1F35E448919BD8F2D5A4C0999BEDBFB1BF6E85A7A6C766FCEE8A82211E3589435C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...Y.=i.........." .........................................................0......}.....`.........................................`...,............ ..................."..............T............................................................................rdata..P...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UQLUB.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):195080
                                                                                                                                                                                                                                  Entropy (8bit):5.723343461604473
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:37812BBF0F9DFB50477C08C19E3B243C
                                                                                                                                                                                                                                  SHA1:ABDF2E88E4C484070DFA592282571F5B1DD67F3D
                                                                                                                                                                                                                                  SHA-256:E0823D6EB1F28586C52749A6BC3FFC2C0D89D0BE5E92DE73FACA491545F3149D
                                                                                                                                                                                                                                  SHA-512:6BB361B3282308A976D105F08CFF1E54ED1007970F74BABB590D905E887256237249D8BF13513F58120B66E49331E987930726394A7472931E5B475BF8BC3368
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y/...N...N...N...t..N...6w..N...6f..N...6a..N...6q..N...N..zN...6h..N...6p..N...6s..N..Rich.N..................PE..d......e.........." ................L........................................ ......!&....@.............................................d.......................8".......*..............................................................h............................text............................... ..`.rdata..$...........................@..@.data...............................@....pdata..8".......$..................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UQR38.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):828872
                                                                                                                                                                                                                                  Entropy (8bit):6.573606522258061
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C72ABC6B7B90A61364B6DD889B5435F3
                                                                                                                                                                                                                                  SHA1:DFE74E40DA0BB442AEEC448B2B3E447067D610BB
                                                                                                                                                                                                                                  SHA-256:0CBBD9691F08434DA3617874F99C6DD87538CBD65B5D8BC39FCE378D4ED29EED
                                                                                                                                                                                                                                  SHA-512:F91B1EB81AF15812311542C663A4AF976003A522F0CEED056E7E3732988EFBA8E03D4502C3D59E1CD71E01FF5014FE95FBE3EB4996FB3811A68413626FECCB8F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..CRg.CRg.CRg.CRf.Rg.%..@Rg....Sg....eRg....uRg.....Rg....BRg....BRg....BRg.RichCRg.........................PE..d......P.........." .................0..............................................f.....`.........................................p...........(............@...e...h...=...........&..............................0L..p............ ...............................text...a........................... ..`.rdata....... ......................@..@.data...,p.......@..................@....pdata...e...@...f..................@..@.rsrc................H..............@..@.reloc...............L..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-UTVDV.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):355336
                                                                                                                                                                                                                                  Entropy (8bit):6.033979069029785
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0CE8021018F4487E2C4627EA9D50A1C5
                                                                                                                                                                                                                                  SHA1:123374E4BAE86561CC44EC2303C6B9E557307973
                                                                                                                                                                                                                                  SHA-256:19EA2D1AD8A46FD05E9F68DF7E1A9439E71BA983D91415D5E8427CF3B7FE7D0B
                                                                                                                                                                                                                                  SHA-512:99DE7C5237FDC3974187D7CFC8EEAC65816A948270D62FC7DED624C7AF72F71A87E760A94D9EF59D86328BE7E0970D7D54D178E4FDA5E32893A19B8EA4DB7AF9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>./z..|z..|z..|..{|{..|s.x|w..|s.n|..|s.i|3..|s.~|...|z..|...|s.g||..|s..|{..|s.||{..|Richz..|................PE..d...s..e.........." .........p......lO...............................................A....@.............................................k.......(............@..t=...B...*...........................................................................................text............................... ..`.rdata..{...........................@..@.data....Y.......&..................@....pdata..t=...@...>..................@..@.rsrc................4..............@..@.reloc...............6..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-VHI33.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):53256
                                                                                                                                                                                                                                  Entropy (8bit):6.288258655520458
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6622B6FD996E03F06DB87FCD74EFB643
                                                                                                                                                                                                                                  SHA1:90F12EDCFAB8148439AA2FA836A59404C585FFAD
                                                                                                                                                                                                                                  SHA-256:F21C6B0E7CC990AA3BA16CD6F73A7A50FF305ADC87A646DE19DA6EE360758F5B
                                                                                                                                                                                                                                  SHA-512:2CB9108A79B743D23BA33ADED707CCCA66DCC648DB5E2822DBD861FE52B0E5D89240FB3470EF9C02E18E2FD9E5E8EE0D4C9B8848E55278FAE3F98AD53BFDB698
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............p...p...p.x....p.....p.....p.....p.....p...q.T.p......p.....p.....p.Rich..p.........PE..d......e.........."......\...F.......].........@....................................9.....@.................................................$...d........................*...........s...............................................p...............................text...nZ.......\.................. ..`.rdata...2...p...4...`..............@..@.data...0...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-VUDE4.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12296
                                                                                                                                                                                                                                  Entropy (8bit):6.713068172188698
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7B2CAAFBE6B2C3D6CBF232610DCCC034
                                                                                                                                                                                                                                  SHA1:ED3F3CB464C779F224729C62ED2A4318F8D0AEFC
                                                                                                                                                                                                                                  SHA-256:BA0AFA1FADD4429693538AA2E85230EDCCC2E481F80B89666907D108D31BED8C
                                                                                                                                                                                                                                  SHA-512:E32C3B6F31C9FE31381884AE683178BFFACA4A88F030335A4502DE42432CC014337F5AC2C2ECB726AFEA15CA3F4C52C26D4024ABED1A4187C4773B8C6FF73977
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....Y$..........." .........................................................0............`.........................................`...H............ ..................."..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\is-VVU8D.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1997
                                                                                                                                                                                                                                  Entropy (8bit):5.280320352914706
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0A3D52F1A9AE473FA34F63A329B9BA4D
                                                                                                                                                                                                                                  SHA1:CBCD0C3F0F09ADAA8B358BEE3EB39A7F3413384F
                                                                                                                                                                                                                                  SHA-256:1304F06BD1152413F1884D8D3943C71990786F2866637608B5AF4EFDF1F7E525
                                                                                                                                                                                                                                  SHA-512:3241D8988D74F1CBD741CCE1E71F5FFA77DFE48D8EE75F3A61A16FD96E6F5F74AC5216C7B7D972BDBCD968B15EF632556D30F59071BEC6C3D59D1019422531B3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:@rem @echo off..@setlocal......@rem the DLLs to be installed must be either in the current directory as this script or..@rem in the SDK BIN directory...@set FOUND_FILES=0..@set CMD_DIR=%~dp0......:installfromCurrentDir..@set DLL_DIR=%CMD_DIR%..@set VBS_DIR=%CMD_DIR%..@call :checkfiles..@if %FOUND_FILES% EQU 0 (goto :installfromSDKDirs) else (goto :goodproc)......:installfromSDKDirs..@set DLL_DIR=%CMD_DIR%\..\..\..\..\BIN..@set VBS_DIR=%CMD_DIR%..@call :checkfiles..@if %FOUND_FILES% EQU 0 (goto :missingfiles) else (goto :goodproc)........:goodproc....rem Remove existing installation..call "%CMD_DIR%\uninstall-easeusprovider.cmd"....@rem Get the complete %DLL_DIR% and %VBS_DIR%..@pushd %DLL_DIR%..@set DLL_DIR=%CD%..@popd..@pushd %VBS_DIR%..@set VBS_DIR=%CD%..@popd....rem Register VSS hardware provider..cscript "%VBS_DIR%\register_app.vbs" -register "VssEaseusProvider" "%DLL_DIR%\VssEaseusProvider.dll" "VSS Easeus Provider"....set EVENT_LOG=HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\libcrypto-3-x64.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:77512692939D0D77217FC17C835D9CC5
                                                                                                                                                                                                                                  SHA1:6611465EC758C9D2B773FDEC96CDD04DE8E2992A
                                                                                                                                                                                                                                  SHA-256:ED6AF85F13D62F30C96B98376297CA6BDB5227A90DB9CD8B95E1D47BF89EE737
                                                                                                                                                                                                                                  SHA-512:015381BCAF5C7D4935A43D6104B2A25B8B412870411C981D960A719CD9ADE40B4DBA763C50DDD48565035AB07C619454BA9167CB1D0008C03C2A980CA54FCB17
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1Kl.u*..u*..u*..|R..w*..|R..w*..|R..w*..R.y.|*..u*...*..u*..V*..|R...)..|R..t*..kx..t*..|R..t*..Richu*..................PE..d.....^e.........." ......@..........(?......................................0Y......UY...............................................Q...... X.x....@X.L....@U.8............PX.......@..............................................(X.h............................text.....@.......@................. ..`.rdata........@.......@.............@..@.data...0.....T..V....T.............@....pdata.......@U.......T.............@..@.idata..=.... X.......W.............@....rsrc...L....@X.......W.............@..@.reloc..~....PX.......W.............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\libiconv-2.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A885D3776B14B6EF7E24D0E04DF69F86
                                                                                                                                                                                                                                  SHA1:5E45FA5E5BF0C982CC122D104AABA82E6BA2D3A1
                                                                                                                                                                                                                                  SHA-256:954B8740A7CBE3728B136D4F36229C599D1F51534137B16E48E3D7FF9C468FDC
                                                                                                                                                                                                                                  SHA-512:ABFB42F440E361453794579C9898DD0D2574A03284993581E098685A0627B0BFC9E073320334452FCE4234B6BC0445619344A735D2BF67272687D6E766EDA11B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....).R.0........& ................ ..........f............................. ......5......... .............................................. .......P.......................`..P............................@..(...................@"...............................text............................... .P`.data...P.... ......................@.`..rdata.......@....... ..............@.`@.bss..................................`..edata..............................@.0@.idata....... ......................@.0..CRT....X....0......................@.@..tls....H....@......................@.`..rsrc........P......................@.0..reloc..P....`......................@.0B/4......`....p......................@.PB/19.....w...........................@..B/35.....T...........................@..B/51.................................@..B/63.....+...........................@..B/77.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\liblzma-5.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:57A37262A5184FE1809F03D4F6B59CCC
                                                                                                                                                                                                                                  SHA1:EC960FFFD7ACD998577E906ED99D1ED6EA03A5C2
                                                                                                                                                                                                                                  SHA-256:CE34910B43D5E4285AECDA0E4F64A1BA06C5D53E484F0B68D219C8D8473332AB
                                                                                                                                                                                                                                  SHA-512:1435BF5E133B2A16B0F1E9DE37AA1215C67AC8A8D394AFB0E4DD4F74B54E70254DEFD88D7FB48D2702B4FCD9E6944FEDBB8D9B9C7AA6EC814746AD81A4725C07
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....*.R....v.....& ................ ..........c...................................."......... .................................................(.......D.......................................................(....................................................text............................... .P`.data........ ......................@.`..rdata..0h...0...j..................@.`@.bss....`.............................`..edata..............................@.0@.idata..(...........................@.0..CRT....X...........................@.@..tls....H...........................@.`..rsrc...D...........................@.0..reloc..............................@.0B/4......`...........................@.PB/19.....w.... ......................@..B/35.....T....0......................@..B/51..........@......................@..B/63.....+....`......................@..B/77.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\libssl-3-x64.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CF78EE8A280D6FFF992AE4CCDE9F7AC2
                                                                                                                                                                                                                                  SHA1:4A87C74E6BB108F46959242617FC34249C2FDEA5
                                                                                                                                                                                                                                  SHA-256:4E10330BF050DD4AD19DB1AF518967EC46722C633F5A0A2063AE7D04E95CFF21
                                                                                                                                                                                                                                  SHA-512:72679BA2D2677ED58BA34C41469F447DA48C553E6B9E13469C6B703C6EFBB0DBD606677F48843C91B70DFE7C92BC47F9771C844E1C8386C028E9944CA8CF33B6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E...E...E...bp..G...L...G...L...G...L...@...E...^...L...~...L...D...[...D...L...D...RichE...........................PE..d.....^e.........." ................................................................b....................................................Q......P....p..D.......PR..............4...P................................................%..8............................text...5........................... ..`.rdata...y.......z..................@..@.data...QL...`...H...N..............@....pdata...[.......\..................@..@.idata..*\.......^..................@....rsrc...D....p.......P..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\libxml2-2.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6EC706E01FA5EF7A4E74526DD6CEEA22
                                                                                                                                                                                                                                  SHA1:C93AF437026AE0CB191B02A34F5413B419005872
                                                                                                                                                                                                                                  SHA-256:2162FD773DAFBB41EB422418761EADE228321AB0790040646028C5F4F867EE42
                                                                                                                                                                                                                                  SHA-512:AC1ED72862E1413FE1909A993D96440CE865932AE6A637E47C49E8A44C0C8F5A8C2E094A38FD3E3124A9BAEEED79393ED8B60904CBD0AB77E5B0DE4083F05958
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...BX.R....!.....& ............. .. ..........p.....................................b........ .................................................l...............................<...............................(...................`................................text...p........................... .P`.data...............................@.`..rdata...).......*...d..............@.`@.bss..................................`..edata..............................@.0@.idata..l............T..............@.0..CRT....X............j..............@.@..tls....H............l..............@.`..reloc..<............n..............@.0B/4......`...........................@.PB/19.....w...........................@..B/35.....T.... ......................@..B/51..........0......................@..B/63.....+....P......................@..B/77.....|....`......................@..B/89.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\mfc90u.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:52BBD0E905E886413A9E6FBDDE8612D8
                                                                                                                                                                                                                                  SHA1:8CF55A4E9B3D73611AB87800B0EEEDCB3427C7A0
                                                                                                                                                                                                                                  SHA-256:05EDBE012DAC7DE6CF398AF14DD6007DD83B63A3E4F930972B12A1EBD75C0D41
                                                                                                                                                                                                                                  SHA-512:6D541026785008DCFAA962C242928AF2206AFE6ED8802E30BA881A583E1F63E6744FE50D3D5A4E2F19AEA81E908EC9A9E13F7070AD5207843553F3F231A704CC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@.......p,....p........>...P.;...........)....p............8.....'.7.....?.....9.....<...Rich..........................PE..d....K1G.........." ...........................x....................................H.....@..........................................g../a..(/..x...............83...~...#...p..@s...'..................................................x...@........................text............................... ..`.rdata..............................@..@.data... ........b..................@....pdata..83.......4..................@..@.rsrc................H..............@..@.reloc..L....p......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcm90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AA6698EC95F726F6931F701047426BC3
                                                                                                                                                                                                                                  SHA1:00CD963EC834CC13D94B67A4F1872716486B010A
                                                                                                                                                                                                                                  SHA-256:450DBCF05DB9E23C4CF96707D729A61FCDE8B80690F7E9A3685652EFF30161A3
                                                                                                                                                                                                                                  SHA-512:74A2EF668C8A45BE3352114332AB46A4281995602EFB84505A686FDE1AB7B0D653E83365AE9FBF6179D4CC358D92C37CB0A5BCDBD7442AE794A481A53F596AA1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k}../../../..1Na.,..Sd....1Ng....K...-.....+../....1Nq.$..1Nv.t..1N`....1Nf....1Nc....Rich/..........PE..d....>1G.........." ..........................Hx..........................................@.....................................................d...............D....................0............................................... ..@............0..H............text............................... ..`.nep................................ ..`.rdata....... ......................@..@.data...............................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..B...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcp140.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5B87055D003DE54C70F79825752D2325
                                                                                                                                                                                                                                  SHA1:B81066EB260DF44E173C8C89E6C660FF9B4B5407
                                                                                                                                                                                                                                  SHA-256:E0ADD11321940F454122E9505E9574957168ABB885176B86D63A092928BC9453
                                                                                                                                                                                                                                  SHA-512:53BB52C3440D9E0CA0F6E019874584B64A657C79BD17B284B9903EAD51DE89C05F958DFF7E676AD237CA87F2C5FD781024E374BD0202169338E1B47B726649EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..0}.0}.0}e..}.0}..}.0}.1}..0}e.1|.0}e.3|.0}e.4|..0}e.5|..0}e.0|.0}e..}.0}e.2|.0}Rich.0}........PE..d......\.........." .........H......`...............................................>.....`A........................................`...h............p....... ...?...6..0>..........`...8...........................P................ ..........@....................text............................... ..`.rdata...... ......................@..@.data....;..........................@....pdata...?... ...@..................@..@.didat..h....`.......$..............@....rsrc........p.......&..............@..@.reloc...............*..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcp140_1.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:51039F47A896DC825C1D508B1C4B98E4
                                                                                                                                                                                                                                  SHA1:B21E93FB4D829692A5DCF3A933B44F154AD83BA9
                                                                                                                                                                                                                                  SHA-256:6EE89634A4174AFD3BEE845CF08CB5A771289E3E1AD4284B9DAC6664B2A97796
                                                                                                                                                                                                                                  SHA-512:7E77A28E4E45E6578C12087E3403DEA3EB7D5C18B91C4E407C9A3DB39FF8BF7D91C0400BDA3F72E1B106EDF4E6825FA6D08D341284A2A7BAA344665190F20A54
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T=..5S..5S..5S.x....5S..M...5S.x_W..5S.x_P..5S..5R..5S.x_R..5S.x_V..5S.x_S..5S.x_...5S.x_Q..5S.Rich.5S.................PE..d......\.........." .........$......`...............................................P.....`A.........................................>..L...L?..x....p.......`..@....:..0>......d...03..8...........................p3...............0..@............................text...3........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..@....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..d............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcp90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F7CD95A47F9C2291DB184C6C4AD7E120
                                                                                                                                                                                                                                  SHA1:67CBA6F7FE2DD19B2640A7217CD968177BF100AA
                                                                                                                                                                                                                                  SHA-256:10859F06F41144FA32CF5DA223511F85FE349B1D76471EF65F0395DAC606EF63
                                                                                                                                                                                                                                  SHA-512:C96E17345D5B893A56D1004227E37A6906AE6DA53E7CB33679E00BB807C28F4016DD6F91A2C038FE843FEA56D08A55CF54EC3EA54B3A77F6EA0A08979AB7C965
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.A.#...#...#......#...qy..#...#..>#...l|..#...q...#...qn..#...qi..#...qx..#...q~..#...q{..#..Rich.#..........PE..d....>1G.........." .....D....................Rx.............................0......y.....@..........................................>..j....0..<................p.......$... .......f...............................................`..8............................text....C.......D.................. ..`.rdata..j....`.......H..............@..@.data....7...P...$...0..............@....pdata...p.......r...T..............@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcr100.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DF3CA8D16BDED6A54977B30E66864D33
                                                                                                                                                                                                                                  SHA1:B7B9349B33230C5B80886F5C1F0A42848661C883
                                                                                                                                                                                                                                  SHA-256:1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36
                                                                                                                                                                                                                                  SHA-512:951B2F67C2F2EF1CFCD4B43BD3EE0E486CDBA7D04B4EA7259DF0E4B3112E360AEFB8DCD058BECCCACD99ACA7F56D4F9BD211075BD16B28C2661D562E50B423F0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........pm...>...>...>..>...>...>F..>...>...>...>..>...>..>...>D..>...>...>...>...>...>...>Rich...>........................PE..d...J._M.........." ..........................sy............................. ............@.........................................pt.......`..(...............pb......P............................................................................................text...F........................... ..`.rdata..............................@..@.data...L}... ...R..................@....pdata..pb.......d...Z..............@..@_CONST..............................@...text.....2... ...4..................@.. data.........`......................@..@.rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcr110.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C72ABC6B7B90A61364B6DD889B5435F3
                                                                                                                                                                                                                                  SHA1:DFE74E40DA0BB442AEEC448B2B3E447067D610BB
                                                                                                                                                                                                                                  SHA-256:0CBBD9691F08434DA3617874F99C6DD87538CBD65B5D8BC39FCE378D4ED29EED
                                                                                                                                                                                                                                  SHA-512:F91B1EB81AF15812311542C663A4AF976003A522F0CEED056E7E3732988EFBA8E03D4502C3D59E1CD71E01FF5014FE95FBE3EB4996FB3811A68413626FECCB8F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..CRg.CRg.CRg.CRf.Rg.%..@Rg....Sg....eRg....uRg.....Rg....BRg....BRg....BRg.RichCRg.........................PE..d......P.........." .................0..............................................f.....`.........................................p...........(............@...e...h...=...........&..............................0L..p............ ...............................text...a........................... ..`.rdata....... ......................@..@.data...,p.......@..................@....pdata...e...@...f..................@..@.rsrc................H..............@..@.reloc...............L..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcr120.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E2CA271748E872D1A4FD5AC5D8C998B1
                                                                                                                                                                                                                                  SHA1:5020B343F28349DA8C3EA48FB96C0FBAB757BD5C
                                                                                                                                                                                                                                  SHA-256:0D00BF1756A95679715E93DC82B1B31994773D029FBBD4E0E85136EF082B86A9
                                                                                                                                                                                                                                  SHA-512:85D6BCAAF86F400000CF991DA1B8E45E79823628DC11B41D7631AA8EE93E500E7DA6E843EA04EDB44D047519DABEF96DCB641ADC2A7B3FAA5CD01E8A20B1F18E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'SuSu.u_'SuSu.u_'SuSu.u_'SuRich^'Su........PE..d......V.........." .....j...:.......)..............................................+l....`.....................................................(............@...s...v...>......8...p................................2..p............................................text...eh.......j.................. ..`.rdata...9.......:...n..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................`..............@..@.reloc..8............d..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcr90.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:23B134891C08C7F04C1747F6BCEC06EA
                                                                                                                                                                                                                                  SHA1:26A77CCF0E62FAA436255E47A0C3C8A818733193
                                                                                                                                                                                                                                  SHA-256:E11CE4B90DB815359B2D76F95F623FC26924C5A254F0540224FA6FEB623817E5
                                                                                                                                                                                                                                  SHA-512:30C89F058B3B9DDD39ED7A3E3C470C2DF08940DBC3EA0CF72CF271FA76EE19D956EE503A3FA2839458FBD2A61658FF3AA7F8326E6ECCAE9C11AC78B4C2B84C14
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2K..aK..aK..al;.aH..aK..a...aU.Ca...aU.UaS..aU.Da...aU.RaJ..aU.TaJ..aU.QaJ..aRichK..a........PE..d....>1G.........." .....n...&.......&........bx..........................................@.........................................0q..Cx..._..(............`...E...n...$.............................................................. ............................text....m.......n.................. ..`.rdata..si.......j...r..............@..@.data....d.......<..................@....pdata...E...`...F..................@..@.rsrc................^..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\msvcrt.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7319BB10FA1F86E49E3DCF4136F6C957
                                                                                                                                                                                                                                  SHA1:3EEA5EE8BAFB2B9975B236C5C5655DF6F4B42AA1
                                                                                                                                                                                                                                  SHA-256:60DE43AB267FD41C9804369B569139ADD30ED4E295C425F44FC04D3FCC95FCA2
                                                                                                                                                                                                                                  SHA-512:B4355548167052C8F520D5B36FCF35FD0C798E36E85E1580B730C9A58D11C36563E71ECAC2431584C14858610BEF5BD99D52A4596587673B675528F91CEA0AD7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.H..............b.5.............d.......r......c.......u.......e.......`.....Rich....................PE..d.....[J.........." .........,.......%........ju....................................2F....@.............................................j..D................p...\......................8............................................................................text............................... ..`.rdata..pj.......l..................@..@.data....V.......N..................@....pdata...\...p...^...H..............@..@.rsrc...............................@..@.reloc..............................@..B..[J....+.[J......[J......[J......[J@.....[Ja.....[J......[J......[J......[J....+.[J......[J......[J6.....[J_.....[J......[J......[J......[J....+.[J......[J....+.[J......[JA.....[Jc...+.[J......[J......[J....+.[J............KERNELBASE.dll.ntdll.dll.API-MS-Win-Core

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\register_app.vbs (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:Non-ISO extended-ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F8522E8F3A35F684B4C67735D7B29F42
                                                                                                                                                                                                                                  SHA1:D06E1A6D3A50EBED02E0D73DB7E27356C3CCC1A5
                                                                                                                                                                                                                                  SHA-256:D9AD6A19DF842E72502E7109DE42EA47CDF2389E7B6C628F465A42FB6DB04E73
                                                                                                                                                                                                                                  SHA-512:73CBC3B1B6BF62F5E7AECA794D5AF6C375179B8C6D92EC42CAB6DDDE4BDE6F9BEEFA2FFEE5CAB1EE1095A44121F81DA6DBDF9E6A96F301523A8214156CD00D01
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:'******************************************************************************..'Microsoft Confidential. ?2002-2003 Microsoft Corporation. All rights reserved...'..' This file may contain preliminary information or inaccuracies, ..' and may not correctly represent any associated Microsoft ..' Product as commercially released. All Materials are provided entirely ..' .AS IS.?To the extent permitted by law, MICROSOFT MAKES NO ..' WARRANTY OF ANY KIND, DISCLAIMS ALL EXPRESS, IMPLIED AND STATUTORY ..' WARRANTIES, AND ASSUMES NO LIABILITY TO YOU FOR ANY DAMAGES OF ..' ANY TYPE IN CONNECTION WITH THESE MATERIALS OR ANY INTELLECTUAL PROPERTY IN THEM. ..'******************************************************************************....Option Explicit....Wscript.Echo "" ..Wscript.Echo "REGISTER_APP.VBS version 1.6 for Windows Server 2008"..Wscript.Echo "Copyright (C) Microsoft Corporation 2002-2003. All rights reserved."..Wscript.Echo "" ......'**************************************************

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ucrtbase.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2381E189321EAD521FF71E72D08A6B17
                                                                                                                                                                                                                                  SHA1:0DB7FEA07B4BC14F0F9D71ECFA6DDF3097229875
                                                                                                                                                                                                                                  SHA-256:4918F2E631EF1AE34C7863FA4F3BD7663B2FDF0FA160C0DE507ED343484AC806
                                                                                                                                                                                                                                  SHA-512:2D51D1DE627DEB852D5CE48315654DFB34115EA9F546F640BB2304CD763D4576EADFF5CD7FD184A9B17BAC8BF37309A0409034D6303662EDFA1A6DB69366B9E5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&.a.&.a.&.a./.....a.&.`..a..6..'.a.l..'.a.l....a.l..p.a.l....a.l..j.a.l..'.a.l..'.a.Rich&.a.........................PE..d......U.........." .........N......`........................................ .......^....`A........................................p+.......................P..p........C.............8...........................@...................H............................text............................... ..`.rdata...u.......v..................@..@.data...."... ......................@....pdata..p....P......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\ucrtbased.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8E901505FE21850AD1E82A377F93CB98
                                                                                                                                                                                                                                  SHA1:3641745F187F0F435CE39146E18ECB57217D8A88
                                                                                                                                                                                                                                  SHA-256:84F26F3825AB76F951F7F6E4A55E00BE2E0C8DF0C05C37B61EB6DA43F382F868
                                                                                                                                                                                                                                  SHA-512:49E4977FAE275AE4E96C9887B07B7E745EBDE6FCE8E820C36CCE2F5D259461631DCFB32D7129448A9396DEA7B23E528D9CB6A21F46A5343B32843253C5B594C3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......H...H...H..0H2..H...H...Hr.^H...Hr.I...Hr.I1..Hr.IU..Hr.I|..Hr.I...Hr.\H...Hr.I...HRich...H................PE..d...E..p.........." ......................................................................`A........................................ j.......E..................@....N..8=.......... ...T...............................................@............................text.............................. ..`.rdata..B...........................@..@.data....,...`.......F..............@....pdata..@............X..............@..@.rsrc................<..............@..@.reloc...............B..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\uninstall-EaseUSprovider.cmd (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7334C2AC5C9A813AE7411641E51EF8C3
                                                                                                                                                                                                                                  SHA1:FBB3568355CEEB2F3FDA2A9D2FA2C80CA3C70508
                                                                                                                                                                                                                                  SHA-256:7D803D9872CB3DE1337C67041CDB9A1056C5C6C28F8A9EEBA631EB0572AB43F0
                                                                                                                                                                                                                                  SHA-512:6536F6C0912A4D03A6D89466252F936FC895D5E0C239E9B85315619D061F88816CF7652B444B6063A6023A6A327EFFABBA85D472D4CD86B67F1FFAC324BB2412
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:@rem @echo off..@setlocal......@rem the DLLs to be uninstalled must be either in the current directory as this script or..@rem in the SDK BIN directory...@set FOUND_FILES=0..@set CMD_DIR=%~dp0......:uninstallfromCurrentDir..@set DLL_DIR=%CMD_DIR%..@set VBS_DIR=%CMD_DIR%..@call :checkfiles..@if %FOUND_FILES% EQU 0 (goto :uninstallfromSDKDirs) else (goto :startuninstall)......:uninstallfromSDKDirs..@set DLL_DIR=%CMD_DIR%\..\..\..\..\BIN..@set VBS_DIR=%CMD_DIR%..@call :checkfiles..@if %FOUND_FILES% EQU 0 (goto :missingfiles) else (goto :startuninstall)........:startuninstall....net stop vds /Y..net stop vss /Y..net stop swprv....reg.exe delete HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VssEaseusProvider /f....cscript "%VBS_DIR%\register_app.vbs" -unregister "VssEaseusProvider"..regsvr32 /s /u "%DLL_DIR%\VssEaseusProvider.dll"....echo...goto :EOF......:checkfiles ....@if not exist "%DLL_DIR%\VssEaseusProvider.dll" goto :EOF..@if not exist "%DLL_DIR%\VssEaseusProviderPS.dll

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\vcruntime140.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9F2B3FAC3440DB16E0C13473B551D12C
                                                                                                                                                                                                                                  SHA1:FEE53A40B376900621E0F897378DE8F161AF00F7
                                                                                                                                                                                                                                  SHA-256:27C51FF3DC2F4CF2B61BDF55FB60148EF0ABB06C2FEAE188C30F1A63F9E29CAA
                                                                                                                                                                                                                                  SHA-512:31DA29833605C01AC66549170513518B634F371E5C1C724EFC92189A4EC54D4EBF8D90582AE3364BCB2B3ADDE29A2FB26BF27719B619ABB5B965C8678B96E5EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........e..e..e../.[.e...'.e..e..e../...e../...e../...e../...e../.K.e../...e..Rich.e..................PE..d......\.........." .........T......`........................................`............`A........................................0...4...d........@....... ..l.......0>...P..t...`...8............................................................................text...C........................... ..`.rdata..X7.......8..................@..@.data...............................@....pdata..l.... ......................@..@_RDATA.......0......................@..@.rsrc........@......................@..@.reloc..t....P......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\vcruntime140_1.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:61D52D5D75CA14A2095CA9E984B4F6EF
                                                                                                                                                                                                                                  SHA1:B2F437DDF1AA3473618D2F2870970F2DB39E5CC2
                                                                                                                                                                                                                                  SHA-256:8B1F9DB2B663E66DC92AEFBC8AFD5C46186C385AD34C587A2D7B00AD51340F14
                                                                                                                                                                                                                                  SHA-512:D02B281B37FAF60947B123A33D0E1F35C261B0C47CF71320147E31F5016DFB150417B64CBABC30C4F270E84887B80DAF16695A49408DF20703F592168BD96E58
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U&..4H..4H..4H.]....4H.]^I..4H..L..4H..4I..4H.]^K..4H.]^L..4H.]^M..4H.]^H..4H.]^...4H.]^J..4H.Rich.4H.........................PE..d......\.........." .....:...2......PB..............................................0b....`A........................................ g..X...xg..x....................j...?..........`^..8............................^...............P..X............................text....9.......:.................. ..`.rdata.......P.......>..............@..@.data........p.......\..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc...............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\vcruntime140d.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4D56968F9E25CDDAE77A5DFD39E5D004
                                                                                                                                                                                                                                  SHA1:75A7370665399CE512F4DBF796A74B927C20D060
                                                                                                                                                                                                                                  SHA-256:2613815661FBFE0045DA144B3EBD76B7C8D2AECAF182A046D76509DA1ADB98A0
                                                                                                                                                                                                                                  SHA-512:C2E67C335DB9A416F116956B4C0D740E38A01CF7243B86603A120F691C150F90F37652972416A6C86C2EDDCD0DABD1E23B260697C1B55B19F7871AC9F721D128
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.....K...K...Kx.NK...K...K...K.y.J...K.y.J...K.y.J...K.y.J...K.y^K...K.y.J...KRich...K........................PE..d.....0].........." .....v...\.......t....................................... ......O.....`A............................................4.......<........................A......|......T...........................0................................................text....u.......v.................. ..`.rdata..,8.......:...z..............@..@.data... ...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..|...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\wimgapi.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5515F09DAD426BDBE97C36A2695B98DC
                                                                                                                                                                                                                                  SHA1:D29D07F2D2C0B6FF0EC61E096FA970971A948E3D
                                                                                                                                                                                                                                  SHA-256:225279F5AE5B24A3019E8D8D7D007FCC1F891966889619DD31B942A5DE908E31
                                                                                                                                                                                                                                  SHA-512:26E4EAD65F5B900DB588BE763965A02E02D5E362878B895FC553ED6E3D66E1DF037CDF46E5FAE8F62D523B8885E9EC9AFDD1B06A2D1054E0C395B6BE77828235
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b.......................................>...7r..............Rich............PE..L.....[J...........-................W........................................p......4.....@.........................0...t...<...........@5...........2....... ..4-.................................. ...@............................................text............................... ..`.data...0...........................@....rsrc...@5.......6..................@..@.reloc...@... ...B..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\zlib1.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F8AFE5B39BD512D26870A7A7D21B36AE
                                                                                                                                                                                                                                  SHA1:B27E01F2C8AA57C06515236B28DB8E094620AB84
                                                                                                                                                                                                                                  SHA-256:A2AC91DB618F4B7C7B25DA854A3C06663FAFE5F13EB3F57261E67D1D4A02F1AF
                                                                                                                                                                                                                                  SHA-512:BB6DF3BC7A7E840AF2F73DD06572EF1F4A0DEA9AF01AA1485DE577B87222AE2FA3660871A612581BA38FB52B4F4488794B7082E27326F238D4D1535EEC73B658
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...3.kL.n........& .........f.................b.............................P................ ......................................... .......\...............................d....................................................................................text............................... .P`.data...............................@.`..rdata..pF... ...H..................@.`@.bss....0....p........................`..edata.. ............H..............@.0@.idata..\............P..............@.0..CRT....X............Z..............@.@..tls....H............\..............@.`..rsrc................^..............@.0..reloc..d............b..............@.0B/4...................d.................B/19.....L............h.................B/35.....I............p.................B/51.....X............~.................B/63....................................B/77.....

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\zstd.dll (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:420AB8712A175F1D65CE6D253E5A747D
                                                                                                                                                                                                                                  SHA1:19A3C6142455F8CED44A4D174686F8306313EC94
                                                                                                                                                                                                                                  SHA-256:314A4337C9321C32FBEF8C6CAEB9D1AE6434376CC5B00710D2A7DC37A41A214B
                                                                                                                                                                                                                                  SHA-512:6A60146BACD2AB4E2C43283B21C2E26B012D6D9AD4119D8D753307A41249DA8D7BD97268D2D76C20CDD4D0E55A23B0DE8271433632A8CADE08E2DEFCEEE520C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5...5...5...M...5...M...5...M...5...M...5...5...5...M...5...M...5...M...5..Rich.5..........................PE..d......e.........." .....T...........]..............................................p.....@......................................... !..I.......<....p.......@...*...B...*...........q...............................................p...............................text....S.......T.................. ..`.rdata..i....p.......X..............@..@.data........0......................@....pdata...*...@...,..................@..@.rsrc........p.......:..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\EUBKMON.sys (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:13E03547B5A9059DFDCEFB1C90BE379B
                                                                                                                                                                                                                                  SHA1:52A01540F10E55B6FCDB15E51F2D667C3AC8469F
                                                                                                                                                                                                                                  SHA-256:368A7AA6DA76D3959F38A95C7C823CB9B1AE5004F10505243897B13B34944025
                                                                                                                                                                                                                                  SHA-512:2D8DC3371907973D4503E34FA9DF61EE8B0CDB62C1631583BCDE84C2DD9D26A1C51188E43289DABDC6BBB16BD2D6FFE054A60CC86624E1A5719B60E80A95CA3C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xf..Xf..Xf..Xg..Xf.....Xf.....Xf.....Xf.....Xf.....Xf.Rich.Xf.........PE..d...P86c..........".................................................................h...........................................................<.......................8(......(.......................................................x............................text...~........................... ..h.rdata..d...........................@..H.data...`...........................@....pdata..............................@..HPAGE................................ ..`INIT................................ ....reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\EUSSRDVR.sys (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F8B70DF320FB949639F65D5B9BF09181
                                                                                                                                                                                                                                  SHA1:5ED89E51E82E908C50F179B9BB473F9BF8D281E7
                                                                                                                                                                                                                                  SHA-256:357043E35AD9C0F05168111E4A69640DCC5366388AFA9A7588BFC820A4312A8F
                                                                                                                                                                                                                                  SHA-512:6F061B644E21D2C6C53FAE64449AD3DC2292CEBDE050808634F5C815B1B309497040D1F5787E280C8BC66B096265BF21BCD941584211A8F02D9A15714271763A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[B.f5..f5..f5.....f5..[..f5..f4..f5..N..f5..H..f5..X..f5..G..f5..M..f5.Rich.f5.........PE..d...y.\e..........".................(........................................ ......(...........................................................<...............H........(......$....................................................................................text...i........................... ..h.rdata..<...........................@..H.data...............................@....pdata..H...........................@..HPAGE................................ ..`INIT................................ ....reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\EuBakup.sys (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2A7E4B4198A151F0649D4F4C748C53F2
                                                                                                                                                                                                                                  SHA1:B42053731F94EB1093A7A5501217E44C0876517F
                                                                                                                                                                                                                                  SHA-256:9527CF04E1FC37118A4B1B84AE47F3CAE69E4449A640CD4D92B6A4EA84985D8D
                                                                                                                                                                                                                                  SHA-512:079DD28A610837D9B7C7B26ADCF9BD7EEF5AA8F21A60C9302A01EF74022EB26986E963A32D9F9818D3C627F1F963D588ABCD645D8C2C0A076F58CBF24D607E8A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f..="ufn"ufn"ufn...n#ufn...n!ufn"ugn.ufn...n!ufn...n&ufn...n,ufn...n6ufn...n#ufn...n#ufnRich"ufn........................PE..d...G86c..........".........."....... .......................................P..............................................................d ..(....0..................H(...@..(....................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT....~.... ...................... ....rsrc........0......................@..B.reloc.......@......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\EuDskAcs.sys (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9FD65902E5726B2EEA982B5DD218A2AE
                                                                                                                                                                                                                                  SHA1:C4BE77D108489614BE4450C613060E5BE9031C83
                                                                                                                                                                                                                                  SHA-256:6F1F87DD55983DEE7010FB8488F7CAF80599C849C7CCF74A809A53616092FE16
                                                                                                                                                                                                                                  SHA-512:F985B4783CACF050EC5B66B65CDD322793B4C3BA44A33948FC8A24645D9909AC162D2A69402FE47DEB118118F848E270DD84C89D6D2B54FA15C7BA7FE6D1575E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.[............;.l.....;...........<...;.......;.......;.......;.......;.......;.......Rich............PE..d.....0b.........."......$...........`......................................................................................................d`..(....p.......P..,....6..X(...........1...............................................0...............................text............................... ..h.rdata..$....0......."..............@..H.data........@.......&..............@....pdata..,....P.......(..............@..HINIT....:....`.......*.............. ....rsrc........p.......0..............@..B.reloc..<............4..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\EuFdDisk.sys (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2B773A2F2F134A78A1BAC7371145E5E0
                                                                                                                                                                                                                                  SHA1:662EE42690CB1CEDC998BFED89A0B7B3AE524FB2
                                                                                                                                                                                                                                  SHA-256:DA81B8530DE449E234449E92D4F23B57FD58B00D5755F0A572F6A3698D93F032
                                                                                                                                                                                                                                  SHA-512:EAD81FCFC5F38F7613119D56F3907C44A0D5997A315C0DBF404EAB28EC0EB2C9B73B259645A10061455472E1D279B7845C54E36FFFF302D78D57A813D7E9354F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..q;.q;.q;....q;..U.q;.q:..q;..@.q;..F.q;..V.q;..J..q;..G.q;..C.q;.Rich.q;.........PE..d.....d.........."......L...*......................................................sS.........................................................(............@.......x...(..........pB...............................................@..p............................text....".......$.................. ..h.rdata.......@.......(..............@..H.data...0.... ......................@....pdata.......@... ... ..............@..HPAGE.........`.......@.............. ..`INIT.................Z.............. ....rsrc................h..............@..B.reloc...............n..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\EuFdMount.sys (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:94BB789CBE1D7AC63D1D136205E20072
                                                                                                                                                                                                                                  SHA1:EE8780C9FCB112D1D5EBCB9DA75DC7C2F7CFDACE
                                                                                                                                                                                                                                  SHA-256:902801D1A1C5870C22158AEC963D02D16D0EAD9FAD3E95CE4953718418093AC4
                                                                                                                                                                                                                                  SHA-512:52FBA566E52CA239F4F286E4A34E980C82ECAB061727C8BBF5587B46A5E8A6DAA6C8DF62166622CEA09E27A9B124FB45A0BE441CD1DF3F5EC541BCF8303E3E97
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..'...'...'....y..'...'...'.....'.....'.....'.....'.....'.....'..Rich.'..........PE..d......d.........."......N..........L...............................................aZ..........................................................(............`..X....h..p(...........B...............................................@...............................text....".......$.................. ..h.rdata.......@.......(..............@..H.data........P.......0..............@....pdata..X....`.......4..............@..HPAGE.........p.......8.............. ..`INIT....B............T.............. ....rsrc................b..............@..B.reloc..`............f..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\euimgprt.sys (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:261576DEDBC5E166D6C98629507E478C
                                                                                                                                                                                                                                  SHA1:BB827B008813D34F03E86EE0AE185FBBEAFE5A19
                                                                                                                                                                                                                                  SHA-256:5692952B3A843DCA3F5972888FF3FB6DD028E09EEAE183F99B627C106A1A920A
                                                                                                                                                                                                                                  SHA-512:DDBA002C62B273E63F97C5BB66EDBCB4CEA067CED5D9BA348A6CC87BA6CDB6AC5D1C4D6918A3C741E07EBDD4CB83B77143BDC2453B37229E68FB66B9AE4EB7C6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A..Q ..Q ..Q ..Q ..| ..v..T ..v..S ..v..T ..v..R ..v..P ..v..P ..RichQ ..........................PE..d...|..c.........."......$...........d...............................................c......................................................\j..<....p..0....@.. ....6..@<..........0!............................................... ..(............................text............................... ..h.rdata....... ......................@..H.data........0......................@....pdata.. ....@......................@..HPAGE.........P...................... ..`INIT.........`....... .............. ....rsrc...0....p.......0..............@..B.reloc...............4..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-1NFCE.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):24152
                                                                                                                                                                                                                                  Entropy (8bit):6.553475375585377
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9FD65902E5726B2EEA982B5DD218A2AE
                                                                                                                                                                                                                                  SHA1:C4BE77D108489614BE4450C613060E5BE9031C83
                                                                                                                                                                                                                                  SHA-256:6F1F87DD55983DEE7010FB8488F7CAF80599C849C7CCF74A809A53616092FE16
                                                                                                                                                                                                                                  SHA-512:F985B4783CACF050EC5B66B65CDD322793B4C3BA44A33948FC8A24645D9909AC162D2A69402FE47DEB118118F848E270DD84C89D6D2B54FA15C7BA7FE6D1575E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.[............;.l.....;...........<...;.......;.......;.......;.......;.......;.......Rich............PE..d.....0b.........."......$...........`......................................................................................................d`..(....p.......P..,....6..X(...........1...............................................0...............................text............................... ..h.rdata..$....0......."..............@..H.data........@.......&..............@....pdata..,....P.......(..............@..HINIT....:....`.......*.............. ....rsrc........p.......0..............@..B.reloc..<............4..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-30Q8E.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):55352
                                                                                                                                                                                                                                  Entropy (8bit):6.619881780291883
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:13E03547B5A9059DFDCEFB1C90BE379B
                                                                                                                                                                                                                                  SHA1:52A01540F10E55B6FCDB15E51F2D667C3AC8469F
                                                                                                                                                                                                                                  SHA-256:368A7AA6DA76D3959F38A95C7C823CB9B1AE5004F10505243897B13B34944025
                                                                                                                                                                                                                                  SHA-512:2D8DC3371907973D4503E34FA9DF61EE8B0CDB62C1631583BCDE84C2DD9D26A1C51188E43289DABDC6BBB16BD2D6FFE054A60CC86624E1A5719B60E80A95CA3C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xf..Xf..Xf..Xg..Xf.....Xf.....Xf.....Xf.....Xf.....Xf.Rich.Xf.........PE..d...P86c..........".................................................................h...........................................................<.......................8(......(.......................................................x............................text...~........................... ..h.rdata..d...........................@..H.data...`...........................@....pdata..............................@..HPAGE................................ ..`INIT................................ ....reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-3VB1G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):36976
                                                                                                                                                                                                                                  Entropy (8bit):6.402156885720672
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:94BB789CBE1D7AC63D1D136205E20072
                                                                                                                                                                                                                                  SHA1:EE8780C9FCB112D1D5EBCB9DA75DC7C2F7CFDACE
                                                                                                                                                                                                                                  SHA-256:902801D1A1C5870C22158AEC963D02D16D0EAD9FAD3E95CE4953718418093AC4
                                                                                                                                                                                                                                  SHA-512:52FBA566E52CA239F4F286E4A34E980C82ECAB061727C8BBF5587B46A5E8A6DAA6C8DF62166622CEA09E27A9B124FB45A0BE441CD1DF3F5EC541BCF8303E3E97
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..'...'...'....y..'...'...'.....'.....'.....'.....'.....'.....'..Rich.'..........PE..d......d.........."......N..........L...............................................aZ..........................................................(............`..X....h..p(...........B...............................................@...............................text....".......$.................. ..h.rdata.......@.......(..............@..H.data........P.......0..............@....pdata..X....`.......4..............@..HPAGE.........p.......8.............. ..`INIT....B............T.............. ....rsrc................b..............@..B.reloc..`............f..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-4GO4G.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):75848
                                                                                                                                                                                                                                  Entropy (8bit):6.585998732639697
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2A7E4B4198A151F0649D4F4C748C53F2
                                                                                                                                                                                                                                  SHA1:B42053731F94EB1093A7A5501217E44C0876517F
                                                                                                                                                                                                                                  SHA-256:9527CF04E1FC37118A4B1B84AE47F3CAE69E4449A640CD4D92B6A4EA84985D8D
                                                                                                                                                                                                                                  SHA-512:079DD28A610837D9B7C7B26ADCF9BD7EEF5AA8F21A60C9302A01EF74022EB26986E963A32D9F9818D3C627F1F963D588ABCD645D8C2C0A076F58CBF24D607E8A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f..="ufn"ufn"ufn...n#ufn...n!ufn"ugn.ufn...n!ufn...n&ufn...n,ufn...n6ufn...n#ufn...n#ufnRich"ufn........................PE..d...G86c..........".........."....... .......................................P..............................................................d ..(....0..................H(...@..(....................................................................................text............................... ..h.rdata..............................@..H.data...............................@....pdata..............................@..HINIT....~.... ...................... ....rsrc........0......................@..B.reloc.......@......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-P0LHI.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):565456
                                                                                                                                                                                                                                  Entropy (8bit):6.639889690324148
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2B773A2F2F134A78A1BAC7371145E5E0
                                                                                                                                                                                                                                  SHA1:662EE42690CB1CEDC998BFED89A0B7B3AE524FB2
                                                                                                                                                                                                                                  SHA-256:DA81B8530DE449E234449E92D4F23B57FD58B00D5755F0A572F6A3698D93F032
                                                                                                                                                                                                                                  SHA-512:EAD81FCFC5F38F7613119D56F3907C44A0D5997A315C0DBF404EAB28EC0EB2C9B73B259645A10061455472E1D279B7845C54E36FFFF302D78D57A813D7E9354F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..q;.q;.q;....q;..U.q;.q:..q;..@.q;..F.q;..V.q;..J..q;..G.q;..C.q;.Rich.q;.........PE..d.....d.........."......L...*......................................................sS.........................................................(............@.......x...(..........pB...............................................@..p............................text....".......$.................. ..h.rdata.......@.......(..............@..H.data...0.... ......................@....pdata.......@... ... ..............@..HPAGE.........`.......@.............. ..`INIT.................Z.............. ....rsrc................h..............@..B.reloc...............n..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-QIG7J.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):66768
                                                                                                                                                                                                                                  Entropy (8bit):6.590366752639433
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F8B70DF320FB949639F65D5B9BF09181
                                                                                                                                                                                                                                  SHA1:5ED89E51E82E908C50F179B9BB473F9BF8D281E7
                                                                                                                                                                                                                                  SHA-256:357043E35AD9C0F05168111E4A69640DCC5366388AFA9A7588BFC820A4312A8F
                                                                                                                                                                                                                                  SHA-512:6F061B644E21D2C6C53FAE64449AD3DC2292CEBDE050808634F5C815B1B309497040D1F5787E280C8BC66B096265BF21BCD941584211A8F02D9A15714271763A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[B.f5..f5..f5.....f5..[..f5..f4..f5..N..f5..H..f5..X..f5..G..f5..M..f5.Rich.f5.........PE..d...y.\e..........".................(........................................ ......(...........................................................<...............H........(......$....................................................................................text...i........................... ..h.rdata..<...........................@..H.data...............................@....pdata..H...........................@..HPAGE................................ ..`INIT................................ ....reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\drv\is-SAG0F.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):29248
                                                                                                                                                                                                                                  Entropy (8bit):6.4472970549984066
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:261576DEDBC5E166D6C98629507E478C
                                                                                                                                                                                                                                  SHA1:BB827B008813D34F03E86EE0AE185FBBEAFE5A19
                                                                                                                                                                                                                                  SHA-256:5692952B3A843DCA3F5972888FF3FB6DD028E09EEAE183F99B627C106A1A920A
                                                                                                                                                                                                                                  SHA-512:DDBA002C62B273E63F97C5BB66EDBCB4CEA067CED5D9BA348A6CC87BA6CDB6AC5D1C4D6918A3C741E07EBDD4CB83B77143BDC2453B37229E68FB66B9AE4EB7C6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A..Q ..Q ..Q ..Q ..| ..v..T ..v..S ..v..T ..v..R ..v..P ..v..P ..RichQ ..........................PE..d...|..c.........."......$...........d...............................................c......................................................\j..<....p..0....@.. ....6..@<..........0!............................................... ..(............................text............................... ..h.rdata....... ......................@..H.data........0......................@....pdata.. ....@......................@..HPAGE.........P...................... ..`INIT.........`....... .............. ....rsrc...0....p.......0..............@..B.reloc...............4..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\is-HLN60.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1240072
                                                                                                                                                                                                                                  Entropy (8bit):6.478387090706198
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:23AD08B186C95358DEA1F1E3FDA5AFAA
                                                                                                                                                                                                                                  SHA1:79F06C7B40B0CCBA09DF4CF63A5F65FDB6061BB9
                                                                                                                                                                                                                                  SHA-256:331FC2DC15B558C7D27A22FECE513FB0CB1ED8BDFB4C5C1E5CF3C5E526845886
                                                                                                                                                                                                                                  SHA-512:AA0F954FC25BDD3EB249CA73B12B33172657A1ED496FC70A744611D0DC319C0502932B64A222A384B02793B3D622E9D8607F44CAAD10A0E00FF975EF8A61E98C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...b..V..........................................@.................................6.....@......@..............................@8... ...^...............*...........................................................................................text............................... ..`.itext.. ........................... ..`.data...h0.......2..................@....bss.....a...P.......&...................idata..@8.......:...&..............@....tls....<............`...................rdata...............`..............@..@.rsrc....^... ...`...b..............@..@....................................@..@........................................................................................................................................

                                                                                                                                                                                                                                  C:\Program Files (x86)\EaseUS\Todo Backup\unins000.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:23AD08B186C95358DEA1F1E3FDA5AFAA
                                                                                                                                                                                                                                  SHA1:79F06C7B40B0CCBA09DF4CF63A5F65FDB6061BB9
                                                                                                                                                                                                                                  SHA-256:331FC2DC15B558C7D27A22FECE513FB0CB1ED8BDFB4C5C1E5CF3C5E526845886
                                                                                                                                                                                                                                  SHA-512:AA0F954FC25BDD3EB249CA73B12B33172657A1ED496FC70A744611D0DC319C0502932B64A222A384B02793B3D622E9D8607F44CAAD10A0E00FF975EF8A61E98C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...b..V..........................................@.................................6.....@......@..............................@8... ...^...............*...........................................................................................text............................... ..`.itext.. ........................... ..`.data...h0.......2..................@....bss.....a...P.......&...................idata..@8.......:...&..............@....tls....<............`...................rdata...............`..............@..@.rsrc....^... ...`...b..............@..@....................................@..@........................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EasyLog.log

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                                  Size (bytes):2103
                                                                                                                                                                                                                                  Entropy (8bit):5.460098865519089
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7AF165BF00663D64C518A593D03ABD4D
                                                                                                                                                                                                                                  SHA1:BD320DCE285B6BF665F7152D9A194A797FDB0953
                                                                                                                                                                                                                                  SHA-256:65561BC0F818395CB8FAE26A693A48FE43AF9B21C24CAE645CAAECD107626497
                                                                                                                                                                                                                                  SHA-512:944E1EB0931E40EBC0F9FC13B4E98167A8B2C1A5ABF16C47672C699DAC64479E56ED30481BEA977B7A85DA2E825A2DC1010CDBE8AF3BA9FA20DD72FE73B6112D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:ParseCmdLine param=EXEDIR=C:\Users\user\Downloads ||| EXENAME=TB_Free_Installer_20240423.17139028322183b390.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=1.0.0 ||| INSTALL_TYPE=0...[2024.04.23 22:07:19 Tuesday]..Install recomand return=259.[2024.04.23 22:07:19 Tuesday]..Install recomand return=259.[2024.04.23 22:07:21 Tuesday]..PostData Start download url=http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17139028322183b390&lang=English&pcVersion=home&pid=3&tid=1&version=free...[2024.04.23 22:07:21 Tuesday]..PostData end.[2024.04.23 22:07:23 Tuesday]..Json parse Data Start.[2024.04.23 22:07:23 Tuesday]..Json parse Data end.[2024.04.23 22:07:23 Tuesday]..CHttpHelper::GetDownloadInfo 45 download info code:0.[2024.04.23 22:07:23 Tuesday]..Install recomand return=259.[2024.04.23 22:07:23 Tuesday]..Install recomand return=259.[2024.04.23 22:07:31 Tuesday]..Install recomand return=259.[2024.04.23 22:07:31 Tuesday]..load h5 Start.[2024.04.23 22:07:31 Tuesday]..lo

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\DataFile.ini

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\InfoForSetup.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                                  Size (bytes):1314
                                                                                                                                                                                                                                  Entropy (8bit):3.8395274751353092
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:843EB374FBF3514EFA989DBDAA7ECF1D
                                                                                                                                                                                                                                  SHA1:4E66BBB180E644277EDB96DD9A46ABB66FA67155
                                                                                                                                                                                                                                  SHA-256:748A1B9DEE3F9128DDBAC0BF1C75D7AEF3E74C1072804EF3D97B2A8B923F7E64
                                                                                                                                                                                                                                  SHA-512:560E902B902CF125197F483C2955A3DABEF24D87F50D34B87D80B7753CC95676D8C84BD80D8ADD91397A534A05D2BFFB27BFF166990F1638A79050DA3ED72581
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......[.H.E.A.D._.D.A.T.A.].....T.O.T.A.L.C.O.U.N.T.=.2.....S.T.A.R.T.I.N.D.E.X.=.0.....[.I.T.E.M._.0.].....K.E.Y._.0.=.T.i.m.e.s.t.a.m.p.....V.A.L.U.E._.0.=.1.7.1.3.9.0.2.8.5.1.....K.E.Y._.1.=.W.i.n.d.o.w.....V.A.L.U.E._.1.=.H.o.m.e._.I.n.s.t.a.l.l.e.r.....K.E.Y._.2.=.A.c.t.i.v.i.t.y.....V.A.L.U.E._.2.=.C.l.i.c.k._.I.n.s.t.a.l.l.....K.E.Y._.3.=.A.t.t.r.i.b.u.t.e.....V.A.L.U.E._.3.=.{.".C.o.u.n.t.r.y.".:.".S.w.i.t.z.e.r.l.a.n.d.".,.".I.n.s.t.a.l.l._.P.a.t.h.".:.".C.:./.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)./.E.a.s.e.U.S./.T.o.d.o. .B.a.c.k.u.p.".,.".L.a.n.g.u.a.g.e.".:.".E.n.g.l.i.s.h.".,.".O.s.".:.".M.i.c.r.o.s.o.f.t. .W.i.n.d.o.w.s. .1.0.".,.".P.a.g.e.i.d.".:.".1.7.1.3.9.0.2.8.3.2.2.1.8.3.b.3.9.0.".,.".T.i.m.e.z.o.n.e.".:.".G.M.T.+.0.1.:.0.0.".,.".V.e.r.s.i.o.n.".:.".f.r.e.e.".,.".V.e.r.s.i.o.n._.N.u.m.".:.".2.0.2.4.".}.....P.A.R.A.M.C.O.U.N.T.=.4.....[.I.T.E.M._.1.].....K.E.Y._.0.=.T.i.m.e.s.t.a.m.p.....V.A.L.U.E._.0.=.1.7.1.3.9.0.2.8.5.1.....K.E.Y._.1.=.W.i.n.d.o.w.....V.A.L.U.E._.

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\tempInfo.web

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\aliyun\AliyunWrapExe.exe
                                                                                                                                                                                                                                  File Type:very short file (no magic)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                                                                                                                                                                                                  SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                                                                                                                                                                                                  SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                                                                                                                                                                                                  SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:0

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\EaseUSToolDll.dll

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):173400
                                                                                                                                                                                                                                  Entropy (8bit):6.578596092442741
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4F1C6B3D52562838A8E9908B90A0DFB5
                                                                                                                                                                                                                                  SHA1:9CF9DEE75FC9E945DEFBEE5FF2FEBC2140ACF50A
                                                                                                                                                                                                                                  SHA-256:134F778517DEDE6C8DCF3E26F79B05262AA1B21E381F619F5CB3FFCD5C44E717
                                                                                                                                                                                                                                  SHA-512:5D0C35EEB998A0E34C0AEF562591BC17BA5195AED23AEBF11BD476BDE8978701413C4BF7D65C2605B02734F57AFD846B255F8A475189C22FE69D5ECC399423FE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=...=...=...4.&.....4.7.(...4.!.....4.1.2...=.......4.(.5...4.0.<...#.6.<...4.3.<...Rich=...........PE..L....*2b...........!.................................................................I....@..........................j..5...d]..........$...............X............................................A..@...............L............................text...!........................... ..`.rdata...\.......^..................@..@.data....9...p.......T..............@....rsrc...$............n..............@..@.reloc..H#.......$...v..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\EuDriverMgr.dll

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):53256
                                                                                                                                                                                                                                  Entropy (8bit):6.620118148961195
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:34AA5DC2DA29A6E0B2E4726C3D93D56C
                                                                                                                                                                                                                                  SHA1:7E030940BECDFA12D8E963D855C799E2CAA90750
                                                                                                                                                                                                                                  SHA-256:1B310956CAD1789C0F0C70DF91716C3D7475BA67B5FF72C4C950938DFBC1726E
                                                                                                                                                                                                                                  SHA-512:1E8F4922593726D9C03E27E27AF7C7B0A82BA7A7056C741AAA107DB4FC3AA2718178AF2C5F2F845D5CD9BCA704DBC08E61D4282B45ABF0DCAC2C5DDA45D1B90B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A{.. ... ... ...X... ...X... ...X... ...X... ... ... ...X... ...X... ...X... ..Rich. ..................PE..L......e...........!.....f...<............................................................@............................c......<........................*..........@...................................@............................................text....e.......f.................. ..`.rdata..S............j..............@..@.data...............................@....rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\TBFirewall.dll

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):102408
                                                                                                                                                                                                                                  Entropy (8bit):6.429186827934796
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:569DCDE4B70FDE916C24CFF276E43AF6
                                                                                                                                                                                                                                  SHA1:3932E69BE690676E4C4706508C7795E1DD107CE5
                                                                                                                                                                                                                                  SHA-256:6B91F5726C6B198B53B476EE855700F9CA40ABD2AF15154308FC80C62EDB3C52
                                                                                                                                                                                                                                  SHA-512:BEFA7C55EA07BE70C7DEC19697935189994768044A4B2E43E96B0ED145C6032EDCAF2CA988C1F887EA293E1936F075A59C22CCDD5331A401E589FCB17BB53EE9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@-...~...~...~.f.~...~../~...~.f.~...~.f.~...~.f.~...~.f.~...~.f.~...~Rich...~........PE..L......e...........!................qJ..............................................U&...............................F.......>..P....................f...*..........................................(6..@...............X............................text............................... ..`.rdata...V.......X..................@..@.data....,...P.......<..............@....rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):6144
                                                                                                                                                                                                                                  Entropy (8bit):4.720366600008286
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                                                  SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                                                                                                  SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                                                                                                  SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\_isetup\_shfoldr.dll

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):23312
                                                                                                                                                                                                                                  Entropy (8bit):4.596242908851566
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:92DC6EF532FBB4A5C3201469A5B5EB63
                                                                                                                                                                                                                                  SHA1:3E89FF837147C16B4E41C30D6C796374E0B8E62C
                                                                                                                                                                                                                                  SHA-256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
                                                                                                                                                                                                                                  SHA-512:9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\is-FJD0F.tmp\version_cmp_english.bmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PC bitmap, Windows 3.x format, 500 x 228 x 24, image size 342002, resolution 3779 x 3779 px/m, cbSize 342056, bits offset 54
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):342056
                                                                                                                                                                                                                                  Entropy (8bit):2.0430455367448648
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F065F5F02110A89DCE4BACD7604B2DB3
                                                                                                                                                                                                                                  SHA1:BA93074F4C239ECCE3A5FFAF673FCB36C997E867
                                                                                                                                                                                                                                  SHA-256:2D4F2E9BC9151030AD72915EED48326315D3ED4EA007F23B21FD2FC063996BC8
                                                                                                                                                                                                                                  SHA-512:379437BE266436316B7A7434924A1EB4DE5F792852D4ABAC1F898F93B5E9B0665558F4625B4CEB2C7898E169D2CA413CDFDD4C330E89B82428785416A01F37CE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:BM(8......6...(....................7....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:06:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2673
                                                                                                                                                                                                                                  Entropy (8bit):3.9886421043710865
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BF71D4EA58CB4E5150AB48B58666B398
                                                                                                                                                                                                                                  SHA1:ACBF33E7F41DC4A74773AED17D50616E33CE2E89
                                                                                                                                                                                                                                  SHA-256:5C20D40687EEC8722537298FA148137D0913B659BB6C5FE0D3F0A7FE21B5ED99
                                                                                                                                                                                                                                  SHA-512:1D19059310FC056671F12E2F72C179F87A140DD8930D02F99CA410CF6FFC60AFF23B12036E72AB866B15364CF8506C37A5EFDA5CA4306367404E70C5F2756DB8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:L..................F.@.. ...$+.,..........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:06:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2675
                                                                                                                                                                                                                                  Entropy (8bit):4.00669204656934
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BBCC18F525C7FCDD3EB8C591138E69B9
                                                                                                                                                                                                                                  SHA1:878CE5D9FD66E7BB9A044D8D3B9BA0FC4EA4E1CC
                                                                                                                                                                                                                                  SHA-256:14638F3C0119D5B462C9FFDA114EF539442112775AD5A6B46BE2D168D6BA554F
                                                                                                                                                                                                                                  SHA-512:3349D86299A81B07079BF100ADE9B2F8B7D368BF154F6B40E0575C14C485C1C772BBFC136D8468E1A633D9486FFE6AB304B637DC777DF167F4572C598592BF01
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2689
                                                                                                                                                                                                                                  Entropy (8bit):4.010694804583468
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:546A19A9C1211CBD861BE4DD6F127EF0
                                                                                                                                                                                                                                  SHA1:40A45C5E8E0B4BBC0F964A7E5A36CEE82D83F177
                                                                                                                                                                                                                                  SHA-256:569D0647800A1887A16BFB39CEB66FA95AAEF1C82F96AAFDF0DFDC513F2D8F85
                                                                                                                                                                                                                                  SHA-512:8C1407BEEFF9B5D49666830AF02DD68001353227089329856A033507688BF93848FD572377ECAA92CF95D6E361B1CA0D0FA044385928F6DAE981CD9D3D358CD0
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:06:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2677
                                                                                                                                                                                                                                  Entropy (8bit):4.0045388753344
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:70162D23155A75F1B1889B12546C8559
                                                                                                                                                                                                                                  SHA1:605C94C2636EB6BF1A8FD86A2AF81954A0B2DDA6
                                                                                                                                                                                                                                  SHA-256:D9FC96D50AF14FD34C7C2F338901D05FAA8BB0923C8D13021FDF1859614890CB
                                                                                                                                                                                                                                  SHA-512:70A2899B1DFB769EDC4AD43A993920A8F2A109482179E3F9E17020912D8F16FB950C6C489B9B06C8E979FD4B13B51C21BEEE4300068784F2D4C8B71565FE1F59
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:06:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2677
                                                                                                                                                                                                                                  Entropy (8bit):3.991442324837383
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:57F4CC3FA8846F325E5640F3FDD0454F
                                                                                                                                                                                                                                  SHA1:6293DA6EA9AAD09EB1781326664AAC440CD12DF6
                                                                                                                                                                                                                                  SHA-256:878921C32819812F6A4FA3FA1796C660B558DA83D742DAED8AE4E41BE8A36631
                                                                                                                                                                                                                                  SHA-512:F572F3D3264204F961F75C0F384DB75A25C5A71C3671AD0056E009CA54B843AEAC2F91D115E2CF44D8BEEB7EBEF756E36FF0FB47F72EFAE6A56F2052A11D4B3C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:L..................F.@.. ...$+.,....&......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:06:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2679
                                                                                                                                                                                                                                  Entropy (8bit):4.002561057210646
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3067FBD5F1DEFFED95B44AE4FEBD033C
                                                                                                                                                                                                                                  SHA1:41C1E9F45E1AE954621D5EF2742492AF1CDA821A
                                                                                                                                                                                                                                  SHA-256:62FE0082354B60DB8CA3FD019BB59B102F3AB0A3AAFABAEFF037BBE7D7AB29BF
                                                                                                                                                                                                                                  SHA-512:FE8172321C6EC231473A20F5FB79B83CCC75CB9EC45F5EEDF99EDE7CEC6883485F4B8D74FD9280006EB242CBCC5CA367A4C33CCF513929E63AC90C30C0E31286
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:L..................F.@.. ...$+.,......w.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                  C:\Users\user\Downloads\3603311b-a1b1-454e-95bc-2313c83bd718.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):13672
                                                                                                                                                                                                                                  Entropy (8bit):6.252952604839969
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AACE5F7728A9C978B03ADD7A82794009
                                                                                                                                                                                                                                  SHA1:0071465C4D29505715BC7E030FACBFE063AA21C1
                                                                                                                                                                                                                                  SHA-256:725AA87944FC4385FA33904FA0C02B95ED2054F4AE609608B39CE1AE14E7D3EF
                                                                                                                                                                                                                                  SHA-512:AD190623E06E81245481812EFC8A21F6A3945D8722B6604271E3C939A800CE48B1BADED6793A98F014823B2864521FCF149DCA50C1D822E41B05CD73DF065AE3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................`........(...@..........................................P................(..*...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata.......P...........................rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\Downloads\TB_Free_Installer_20240423.17139028322183b390.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B9A625522B3DBDE8B3DAF4CDA02AA696
                                                                                                                                                                                                                                  SHA1:A9D8CF95D8BB989FFAE0F9B07FEA292CA16D7A93
                                                                                                                                                                                                                                  SHA-256:7898ACFCC553E78206FA6EF705BF1F1EABE04F3A37F774B03EA57D11163D669E
                                                                                                                                                                                                                                  SHA-512:FCD75D4353D8FF5C924B53BDE34F0D9860E3CE9BF045629EA2570F138CEF4351FE92C1DE142D2EFE05EC86F1012ED06C4F19A17863A878D869DA3C3892406B72
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................`........(...@..........................................P................(..*...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata.......P...........................rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\Downloads\TB_free_easeus.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A78798643AC0FFE5765110D598F79549
                                                                                                                                                                                                                                  SHA1:3EE728CB5FC38421545E5425AC89F5975C8F9E59
                                                                                                                                                                                                                                  SHA-256:41719F9B4723D632B05666E002B2C9C41F9C038D6FA7B2A4169C6B30325D2EA9
                                                                                                                                                                                                                                  SHA-512:4C96FC69EF132C0D4E3D0C17B76DC93F32DA892F8D284DB39C63F5BB54BEBA19F0A7DFF97B7227A3DD923B7A56D19FE5FEE833563D65B4D6A49C5FA1B8FBE645
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...a..V..................................... ....@..........................@.......&9...@......@.......................................{............8..*...........................................................................................text...4........................... ..`.itext..D........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.....................................rdata..............................@..@.rsrc....{.......|... ..............@..@....................................@..@........................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\Downloads\TB_free_easeus.exe.temp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\downloader_easeus\1.0.0\3free\EDownloader.exe
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                                  Size (bytes):154738720
                                                                                                                                                                                                                                  Entropy (8bit):7.999977778527045
                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A78798643AC0FFE5765110D598F79549
                                                                                                                                                                                                                                  SHA1:3EE728CB5FC38421545E5425AC89F5975C8F9E59
                                                                                                                                                                                                                                  SHA-256:41719F9B4723D632B05666E002B2C9C41F9C038D6FA7B2A4169C6B30325D2EA9
                                                                                                                                                                                                                                  SHA-512:4C96FC69EF132C0D4E3D0C17B76DC93F32DA892F8D284DB39C63F5BB54BEBA19F0A7DFF97B7227A3DD923B7A56D19FE5FEE833563D65B4D6A49C5FA1B8FBE645
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...a..V..................................... ....@..........................@.......&9...@......@.......................................{............8..*...........................................................................................text...4........................... ..`.itext..D........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.....................................rdata..............................@..@.rsrc....{.......|... ..............@..@....................................@..@........................................................................................................................................

                                                                                                                                                                                                                                  C:\Users\user\Downloads\Unconfirmed 979515.crdownload

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2675096
                                                                                                                                                                                                                                  Entropy (8bit):7.993108207756652
                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B9A625522B3DBDE8B3DAF4CDA02AA696
                                                                                                                                                                                                                                  SHA1:A9D8CF95D8BB989FFAE0F9B07FEA292CA16D7A93
                                                                                                                                                                                                                                  SHA-256:7898ACFCC553E78206FA6EF705BF1F1EABE04F3A37F774B03EA57D11163D669E
                                                                                                                                                                                                                                  SHA-512:FCD75D4353D8FF5C924B53BDE34F0D9860E3CE9BF045629EA2570F138CEF4351FE92C1DE142D2EFE05EC86F1012ED06C4F19A17863A878D869DA3C3892406B72
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................`........(...@..........................................P................(..*...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata.......P...........................rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Windows\System32\is-TMN05.tmp

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):29704
                                                                                                                                                                                                                                  Entropy (8bit):6.494779491777379
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:27116DFD8DB318320687F56DDA23D5C2
                                                                                                                                                                                                                                  SHA1:CFE5C5CBD36BB220393C021FF47369273C903775
                                                                                                                                                                                                                                  SHA-256:D5338217EA772A71A599CFC6542D6DAD8CA1474E8F2C607FA6175DA48EE5ABC7
                                                                                                                                                                                                                                  SHA-512:A938D139D075A86E9E0B33CFCC48644C0609BDA57E97EEB85BC29672EAB9F6A4815EDF80B815C7ECAD99A6EDAB7E493E0D917A00C2B0A97CECE7E1676D43280E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1CZ.P-..P-..P-...V..P-..P,..P-...P..P-...@..P-...C..P-.!_s..P-...U..P-.Rich.P-.........................PE..d...K..e.........."......8...........9..............................................Q................ .......................................A..(....p.......`.......J...*..........P...................................................H............................text...>6.......8.................. ..`.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..B.reloc..b............H..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  C:\Windows\system32\fbnative.exe (copy)

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\is-2TU8E.tmp\TB_free_easeus.tmp
                                                                                                                                                                                                                                  File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):0
                                                                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:27116DFD8DB318320687F56DDA23D5C2
                                                                                                                                                                                                                                  SHA1:CFE5C5CBD36BB220393C021FF47369273C903775
                                                                                                                                                                                                                                  SHA-256:D5338217EA772A71A599CFC6542D6DAD8CA1474E8F2C607FA6175DA48EE5ABC7
                                                                                                                                                                                                                                  SHA-512:A938D139D075A86E9E0B33CFCC48644C0609BDA57E97EEB85BC29672EAB9F6A4815EDF80B815C7ECAD99A6EDAB7E493E0D917A00C2B0A97CECE7E1676D43280E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1CZ.P-..P-..P-...V..P-..P,..P-...P..P-...@..P-...C..P-.!_s..P-...U..P-.Rich.P-.........................PE..d...K..e.........."......8...........9..............................................Q................ .......................................A..(....p.......`.......J...*..........P...................................................H............................text...>6.......8.................. ..`.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..B.reloc..b............H..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                  Chrome Cache Entry: 640

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 31 x 31
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):2313
                                                                                                                                                                                                                                  Entropy (8bit):6.7731648071418515
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1464100E1AEB81B9D7C5AF8D1524AFD4
                                                                                                                                                                                                                                  SHA1:AE9613E7ADE432531EB6DB72FF96E70E32B5FFA9
                                                                                                                                                                                                                                  SHA-256:3E3E498C1BE6359D5E048B8C707113F312D9BD3B1F76C438359A5AE24975D2A2
                                                                                                                                                                                                                                  SHA-512:F4BC88AEB959951699639AB27622D4239464B9CB0C3EDF07A30FEB66CB6A74E90D0A7B77BAA4F14D917BAA152F2D79986F6DDF7EAC59A3AB7187DC3B3F8B3F6B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:GIF89a.....................sssYYY..........................!..NETSCAPE2.0.....!.......,.............Ii.5......1F.Rc.h..LK..$..h;.Mt..6..2hV...I.@.R.sr.H......~.....h3..M...... g..ow}t}C..k....._.....R...........!.....K.....C........4.............r.....C..!.......,.............I..5.......1E.Rc.h..LK..$..h..Mt..6..bhV...I.@.R.sr.H.Z....~....2h3..M.....}!g..ow}t}C..k....._.....R...........!.....K.....C........4.............r.....C..!.......,.............Ii.5.......1J.Rc.h..LK..$..h;.Mt..6..RhV...I.@.R.sr]H......~....bh3..M...... g..ow}t}C..k....._.....R...........!.....K.....C........4.............r.....C..!.......,.............I).5......1A.Rc.h..LK..$..h..Mt..6..hV...I.@.R.sr%H.Z....~....Rh3..M.....] g..ow}t}C..k....._.....R...........!.....K.....C........4.............r.....C..!.......,.............I.5...D...1@.Rc.h..LK..$.Mh;.Mt..6...hV...I.@.R.sr.H......~.....h3..M.....=!g..ow}t}C..k....._.....R...........!.....K.....C........4............

                                                                                                                                                                                                                                  Chrome Cache Entry: 642

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Web Open Font Format, TrueType, length 146252, version 1.0
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):146252
                                                                                                                                                                                                                                  Entropy (8bit):7.9965740000545855
                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:ABCB3DDD33DD10CDE9CB7087655EA6F5
                                                                                                                                                                                                                                  SHA1:D04ECC5849B1DECF6043A9B249E867CCC5848C43
                                                                                                                                                                                                                                  SHA-256:5234E1EDDDFA3294972B7DCE618B6757D1E6DA362BEC95C368C9456EC7FE6A7C
                                                                                                                                                                                                                                  SHA-512:3E18825DBD0C385FED6164F820C46E3AA83688A1137D69118B558E010A3E0DCB57CD572EA2DFFA256C90B3047409CEB3DF845694420C75D92F180EDB3C761BE7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/typeface/icon/iconfont.woff
                                                                                                                                                                                                                                  Preview:wOFF......;L......P.........................GSUB.......;...T .%zOS/2...D...D...`<iQ.cmap...........@....glyf...$...|....D...head..#....1...6G...hhea..#....!...$*-'.hmtx..#....Z...H...Xloca..&T.......L.C..maxp..+X....... ....name..+x...@...g..<.post..,..........T95x.c`d``.b0`.c`rq..a..I,.c.b`a...<2.1'3=.......i. f....&;.H.x.c`aKb........t.....B3.f0b...2.23`..i.)...1............0#."&.....x...g..........X.c.....ED@. 6P..E.w.I...b.QS.Q...XbLbb.3..."/N>@x...g....{.9.b.....P/...?..G...u......k..7..x^YQ>.......}Z[][S...}....u.....PQ>..g|...........uG...o_...+..T....h.z............{|...P]t"...>V..U?.Wg..O..?...._....7|..VK].o..ktH..5.........j.c.J...:.a.......=.X..:[..S.5DC5L.5B#5J.5F.j..j....h..j.&j.&k..j..k.fj.fk..i..h..j....=....V.%..W.J......zG..=}....o.6.'.....?....|.xUG.g..w....7^.{].......IuTW.t..h.m.....jS..Kt....zP..q......PG].;.L.k.m...5.i.5..N.k....v.i.U.u.v...CM......G.j?.[t...:X..0..#u...':N'.$..Su..d%/...,a)...<...B.0.y,g>.xFw0.Y..).f2S..s..tf

                                                                                                                                                                                                                                  Chrome Cache Entry: 643

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 49 x 51, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):538
                                                                                                                                                                                                                                  Entropy (8bit):6.376529302403694
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:82873CC34713035E0BB20D885668CB35
                                                                                                                                                                                                                                  SHA1:22AE996456F5EE8909479A8C3E6A6EA6E00F9729
                                                                                                                                                                                                                                  SHA-256:6E33F9629F8761A68560148B4D9F1F3BE0EA728CFB9D50FC78FE9F6FB8B2C40D
                                                                                                                                                                                                                                  SHA-512:90F3233FDD0ECB708B65CCE7402DB89F0AB3E27BCA3C5FF1C5328D62D888C586DAF96ECFC42F32315074D83AC49118298E7425EB8332F75EA3648979B363BAD7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/tb/index/2022/solution-icon-2.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...1...3........%...lPLTE............................................................................................................t".....#tRNS...@...y`..f...#Q...p..I*......F?...7...:IDATH....r.0..avB.TPDE...~.wl`..L.$......$..5..........d..y...VD.. ........6..B1.U.. .o. ). ..1<..Gkdp...?.eAl..h>.<.D...j..J.FU..Zs[.....E^.^.....%.;..U.]B+.f...[.OU3:z....~.....N.)..8g#?.S\6.$t...Q..c\]^..$..{\..M..(......yw4.W..:M_.I...;.2vG...a....|..w.W..........-7..!.t..S.|\.....e.1:....]..../.)..|".....IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 644

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):95948
                                                                                                                                                                                                                                  Entropy (8bit):5.390377559358716
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:32865F8B0518670A04C81659CD3871DB
                                                                                                                                                                                                                                  SHA1:8CAAAAFBAC3E189C42DED3278355BDCAAA95DC99
                                                                                                                                                                                                                                  SHA-256:1492D0BB67B07F042F35595A70369DB5BD89E02CCA12DE3140B2519A381ABA69
                                                                                                                                                                                                                                  SHA-512:1CDC055D1ED4EA4263379C97A45184834231CA0C02100C8600E4EEC7AC2F5E928D385AFC0044E262B54A77A80BBE1F9A07836E8C7F503CFED4C6D1AB430CF9D5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/js/jquery.js
                                                                                                                                                                                                                                  Preview:/*!jQuery v1.11.3 | (c) 2005, 2015 jQuery Foundation, Inc. | jquery.org/license*/!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.3",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){return

                                                                                                                                                                                                                                  Chrome Cache Entry: 646

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (596), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):596
                                                                                                                                                                                                                                  Entropy (8bit):4.740905347243311
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6FC8EADE50343381CCD09636152DE4F9
                                                                                                                                                                                                                                  SHA1:7437A0C8C0DED74D0AE3DD51BFB7891361C7D877
                                                                                                                                                                                                                                  SHA-256:968AAD2C0F4D01BD59DF8D89E92721512E1CCE33140152495332EF86F4CBF4CC
                                                                                                                                                                                                                                  SHA-512:5828731D446A400DE27B7F77C22B1D68C4377CDE028A262D35B589778D474A9BDC0126B41D307BD26976EF19FB7C0AF5B6F66F66CA039017D252D223E7ADDF9D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default2/css/iconfont.css
                                                                                                                                                                                                                                  Preview:@font-face{font-family:iconfont;src:url(/default/typeface/icon/iconfont.eot);src:url(/default/typeface/icon/iconfont.eot#iefix) format("embedded-opentype"),url(/default/typeface/icon/iconfont.woff) format("woff"),url(/default/typeface/icon/iconfont.ttf) format("truetype"),url(/default/typeface/icon/iconfont.svg#iconfont) format("svg");font-display:swap}.iconfont,*:before,*:after{font-family:iconfont!important;font-size:inherit;font-style:normal;-webkit-font-smoothing:antialiased;-webkit-text-stroke-width:0 .05rem;-moz-osx-font-smoothing:grayscale;vertical-align:middle;display:inline-block}

                                                                                                                                                                                                                                  Chrome Cache Entry: 647

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):102802
                                                                                                                                                                                                                                  Entropy (8bit):5.540204019213583
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D92FE6DC61FB8766DA249A514CA3CBC6
                                                                                                                                                                                                                                  SHA1:9566D7926A051D4873C478756465B564082E63D1
                                                                                                                                                                                                                                  SHA-256:27E681692A86A9483085D08150BD69C65C2D68A1944E6F8C348A3E90308AA7B3
                                                                                                                                                                                                                                  SHA-512:4B185D970153765B78CED5BC7C3A97A038BC7585C3C6FEF982840A08F89DAC2016E48442D74A57A161F15E6D440D8F13162DBC17303307321B53116FE47BA9F8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://td.doubleclick.net/td/rul/1064956115?random=1713902825617&cv=11&fst=1713902825617&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
                                                                                                                                                                                                                                  Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7572346854"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7589463467"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7589469449"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7590176680"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7590178096"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7604592705"}},{"action":1,"interestGroupAttributes":{"owner":"h

                                                                                                                                                                                                                                  Chrome Cache Entry: 649

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (1900)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):124728
                                                                                                                                                                                                                                  Entropy (8bit):5.538660649297516
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:713BDAF9B42EEBEF332322C63A246B33
                                                                                                                                                                                                                                  SHA1:639646315DEDF1202C4D279CE18C53157F08E5BE
                                                                                                                                                                                                                                  SHA-256:CE3F2BF378867ADCC2CB1F399DD170794872F0120F0622CD9C2272A7E96F2147
                                                                                                                                                                                                                                  SHA-512:E5AC9676745BB214E79A22EE4BAFFB7167030A39C25BAFAD7496388037E74087B73BA747A24A7DE29EE1B5DBF8F9E86626423E63E09F53B66411B4B0CEC73F93
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.googletagmanager.com/gtag/js
                                                                                                                                                                                                                                  Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[],. "tags":[],. "predicates":[],. "rules":[].},."runtime":[ .]...........};...var ba,ea=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},fa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},ia=function(a){for(var b=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global],c=0;c<b.length;++c){var d=b[c];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");.},ja=ia(this),ka=function(a,b){if(b)a:{for(var c=ja,d=a.split("."),e=0;e<d.length-1;e++){var f=d[e];if(!(f in c))break a;c=c[f]}var h=d[d.length-1],l=c[h],m=b(l);m!=l&&null!=m&&fa(c,h,{configurable:!0,writable:!0,value:m})}},la=function(a){return a.raw=a},ma=function(a,

                                                                                                                                                                                                                                  Chrome Cache Entry: 652

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 321 x 161, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):7170
                                                                                                                                                                                                                                  Entropy (8bit):7.95112939298224
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CAF1A5C6054D94FA400453FD64376923
                                                                                                                                                                                                                                  SHA1:DB1569FBB9D11B2B53262BCCADA5BE8EA0D3C048
                                                                                                                                                                                                                                  SHA-256:C05104C0A0511E7A4223F284B10F7ED45F429288480085FAAEDFF02C9272C7FC
                                                                                                                                                                                                                                  SHA-512:0292AAAC4E6AB1DE0A93E42381497B9907D71C83858BB947C27B25783E606EF5E4CD7631CF08B1E1F8A85E5A4B0643934A1A5D52A9CF59A829875D2B4A736ED2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/tb/index/2022/solution-2.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...A.........n..5....PLTE...(A.#A}&?{.9r#?|z..#:vj.....u.....Hi.^{.\r..Bw.Q.Qp.l..... !U_p...x.....y........<`....$-eMY....2U.......2`.T...........2Y....-\.x...'ma..-T.7j..............^..,Z.Fx.......2[.^..Eu.b..b.(\.NY~...U.....9q.Iy..!\........'_....R[}....*r!3sN.....T...X...N..IW|M.V.........~..K..f..L]..+h...W..D..N\.Z.f..@K...G...|..t|.....N......................J.R...]................L.....%k......Y..8l.O....Aq....Dx........0d.@t.J}..e....T..V........q....Dx.K..G|.5`.G.J....R.=p.}..=Mq....Z...<l.S.......6...O...O...b..H.....X~.i{.9i.....4h.....@......b.E..9f...O...JVwj...(4r...w..=..p.....7.....Q`....+J....i.."C.4.z....../>{.[.Af. )\6....@.....Y.r..;....e7R.eo..mu......~'N.b..w..6y.`...u...4l...w68a..x6o..m`WDJ.f..yhwXR..6/7.,....rtRNS......5.F"=-.O !.X)...n.h...X`....j.:....3....\...S..r...K......t.<.P.....I..~g.........Q....u..........5...EIDATx...w..q....;..4....!......bo"v....V...".i.pVQ.)....j.

                                                                                                                                                                                                                                  Chrome Cache Entry: 653

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):68
                                                                                                                                                                                                                                  Entropy (8bit):4.403590365002627
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EDB2AA47631C67A43709D4CCD2501E33
                                                                                                                                                                                                                                  SHA1:87475B448C53CF32FFE78AB121DB8BAB41D478E0
                                                                                                                                                                                                                                  SHA-256:6019C3C9E47DC991F8D9937DEAFBB0740C2E61E321324798CB508773B0814824
                                                                                                                                                                                                                                  SHA-512:65820EEAF261F01988570AFE7866D9B83901950DFBD89542009A1FAAAE520E1AF2FA08789B7E94A64B0E1A3BDC39256354EFE1D38856621851DD65E80505DBB2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-HIdb8X7SFkuR3iGMtOHNqjTloLIsGaUCSsP0Mw&us_privacy=1---
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.....................IDATx.c........o.......IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 654

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 435 x 48, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):350
                                                                                                                                                                                                                                  Entropy (8bit):7.044137919801799
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:500E3BEAE405075CC36437A7A3CBF01E
                                                                                                                                                                                                                                  SHA1:C82DB7E7F4A8076067EBAB97479CE9F8962C2270
                                                                                                                                                                                                                                  SHA-256:6A5693AB0993CD73DDE3EA83A19EB4A4A8690CE24911460E5CE3D00FE57036C6
                                                                                                                                                                                                                                  SHA-512:C686DCE022AD7D2D68A9DD2E737D4BDE067E1C1A92FC60B9063E82D8494863E402E7D2E18BE9E84498CE018EB1531E93311EDBE8B6E56DA3FB6B10A973A71FC4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/404-title.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.......0.....i..v....PLTE.....d....d....d..3.....tRNS...M0.n....IDATh...K.. .F.sK:......4].....4McU...g.~.....u..t.h..].C5,..^....N.... j...$i.OQ...d...7.G..fr...-1..h.9'F+,E-Z`.h.u^.6..h.mB...C.ls2.B[T...L...O...ij^.V'.Lf...._sB....M..M.P....h.....F2..h9.{......76...K.....N......$..pU.V..{q.:......[........IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 655

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 250 x 254, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):10923
                                                                                                                                                                                                                                  Entropy (8bit):7.928920786123642
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:40BFAD21F3C7530B5ABC97C227C7A2F5
                                                                                                                                                                                                                                  SHA1:B6C4F5C8D93BFAB4C49772D8F7FC9C7D97D8FDEC
                                                                                                                                                                                                                                  SHA-256:08A1B5725EE32900200949BF42EADAB075E36A3C5B848A231C9715B2272718ED
                                                                                                                                                                                                                                  SHA-512:03DF21FF6A000BB94E9872A4F0B33FB73A2D4BD121828FCAFD57AD82156C167837B29A2988C9CDA3958EF737EAF5B1EB9A4A0D1D9460E00BEFD964757D8D7165
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.............$.......PLTE......"..*CQ......$5D..................Ep.[hy,...n..y...'Q^oS_n...Ah..#.pqS_o..+.. .z.........Otp........q~.&......|.u..r...m.~........8X......<............t........X..;u....S_oNZi.z..Hwp....'%c.JUc.T.%g.......)........FP].1I.>g(...Fo.f..Us...*...Bk%+3.;c[..<FQ....9_.......Ol...\........AKX9..3:DZ..'.....,3<...\...5Z.Kg.7P.Ry\.....$l..#).GbX........(.....Z...=U\..8@J.r.[.........:O....k..v..k..Nr*..@...B[...Z...p.....Y{B...}..0T[...^.Z...d.Tgv...<...|.S...d.$q...........Y.B..>.....5..M........Z..4...3D...A../j.!w.Gx.4.........L_...M..!}.)..!..D..P..<........;..x..9q.i..@..R.._..)..<........Q.....Z...+7.{....r....0@[k....O..^.....I..I....T..0..4.....Cdq.............\z...Xs.K..(:P'...a.;....b..4..(..J.....:..6..P..@..6Sh.QR....BhS.....n..j...........y......<tRNS.8.... &6J.We;g.j.Z.........8...........`...T..f....[.|...'.IDATx....k.`......8./.7G.*....<x...F.`.. 2V.......]d0.tP..........4D..2...~.y...'K)..#k.wZ../>.S...........

                                                                                                                                                                                                                                  Chrome Cache Entry: 656

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (563)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):215149
                                                                                                                                                                                                                                  Entropy (8bit):5.51771135300933
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:122F268867C32B0C7D1A5E64EA5D59DB
                                                                                                                                                                                                                                  SHA1:F0B84A02037118FE4BEC132D1530390D2593C44B
                                                                                                                                                                                                                                  SHA-256:4D00B69073723B96A5F90FF41BCA10F96A1E0D4E7F27FABE07241C9C3F4B2880
                                                                                                                                                                                                                                  SHA-512:7ABCE5517E10122DDDE653591DAA5516FE9DD022D8EA5FF2EA9E64E1BD632925D1EB279985F59C05AC4D11AED6E1960CAEDAB707D6EA96299F928591919855A5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://mc.yandex.ru/metrika/tag.js
                                                                                                                                                                                                                                  Preview:.(function(){try{(function(){function bf(a,c,b,d){var e=this;return A(window,"c.i",function(){function f(F){(F=cf(l,m,"",F)(l,m))&&(V(F.then)?F.then(g):g(F));return F}function g(F){F&&(V(F)?p.push(F):ma(F)&&x(function(N){var L=N[0];N=N[1];V(N)&&("u"===L?p.push(N):h(N,L))},Ma(F)))}function h(F,N,L){e[N]=Tl(l,m,L||q,N,F)}var k,l=window;(!l||isNaN(a)&&!a)&&Zd();var m=Ul(a,$d,c,b,d),p=[],q=[jh,cf,kh];q.unshift(Vl);var r=C(U,Xa),t=M(m);m.id||Ya(Pa("Invalid Metrika id: "+m.id,!0));var y=ed.C("counters",{});if(y[t])return Ib(l,.t,"dc",(k={},k.key=t,k)),y[t];Wl(l,t,lh(a,c,b,d));y[t]=e;ed.D("counters",y);ed.Ga("counter",e);x(function(F){F(l,m)},df);x(f,ae);f(Xl);h(Yl(l,m,p),"destruct",[jh,kh]);Rb(l,D([l,r,f,1,"a.i"],mh));x(f,W)})()}function Zl(a,c){delete H(a).C("cok",{})[c]}function Wl(a,c,b){a=H(a);var d=a.C("cok",{});d[c]=b;a.D("cok",d)}function $l(a,c){var b=""+c,d={id:1,aa:"0"},e=am(b);e?d.id=e:-1===ib(b,":")?(b=Ea(b),d.id=b):(b=b.split(":"),e=b[1],d.id=Ea(b[0]),d.aa=be(e)?"1":"0");retur

                                                                                                                                                                                                                                  Chrome Cache Entry: 659

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):43
                                                                                                                                                                                                                                  Entropy (8bit):2.7374910194847146
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:07FFF40B5DD495ACA2AC4E1C3FBC60AA
                                                                                                                                                                                                                                  SHA1:E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
                                                                                                                                                                                                                                  SHA-256:A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
                                                                                                                                                                                                                                  SHA-512:49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-x8msb37SFkuR3iGMtOHNqjTloLKhuNSelifhsA&us_privacy=1---
                                                                                                                                                                                                                                  Preview:GIF89a.............!.......,...........D..;

                                                                                                                                                                                                                                  Chrome Cache Entry: 660

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Web Open Font Format (Version 2), TrueType, length 28228, version 1.0
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):28228
                                                                                                                                                                                                                                  Entropy (8bit):7.992055228293546
                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:998C9428A2EF5273284A60AA4B4DD2C0
                                                                                                                                                                                                                                  SHA1:6DA5681031BD6D27331474BBA5C8E93197B05C4F
                                                                                                                                                                                                                                  SHA-256:9504EE9A4ED55AA1D99B295CD7918E28FECED25EF7DD97C86930B0668953B0A5
                                                                                                                                                                                                                                  SHA-512:4F5DB9888E3E19A3EE02FE9B15C014050212ED7BD53CD59CDCBBB1CF3E45C56F2A43EEFAA89E20855F20E35EFA107CFA7DF25FE107C957BAF0D210F92A78C0B6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/typeface/Lexend/Lexend-Regular.woff2
                                                                                                                                                                                                                                  Preview:wOF2......nD......3...m...........................,...t..x.`?STAT.........P..Z.....6.$..2. ..Z..k..[..q.=..9uWy3.........MD[y..n.7c...^Rf.....d.Q@..._...~A....*...>..T...T=...62.=B..g.I.3..I..n..Ww.$v......%.....Z`R.Ld... M"ke.a..-..r..z...P.I.,.0)y.|>.,...M.Up.........~......T..`R......Ia.n}.+.mr[n....[]...\.......S/..\.GFV..0...sO.../.......~.>ji...q.B.-*.....xJS..*...:.qPH..C.......f...\..!9f.......p....../$.t..h$i....J.9B..cx~..G]..7$.....R%u.....@......s.....\t.._..........5.P"A....v....-.9..J`...>CX5.....1;.K..|W.^'<....{0.o(Ff!8..I..C.E7S.g..^.&_0.........#...f.v.LcW C.Z.D...I-..>T.......hv.dS.v...R.e...a_5.0k.T.R.......b..I.#...~G....Glx..".#. F1..,j....?.....O8.@D..+...2...dY.\n.R..kVi*..u.U2.i..w%x#.`....-..G....?....=.[.;C...U..G.N<.@...Ngb...~P?....BH..e.92...!S..Y.m...t...Mx.5..-...:i1..Wk..x.{x..q........<@.1@.9..C....6........?|.P.....].P.Q.#.t!.J....@...p.es2YN+uX..at....Ms.5.e.a...Y....L..=...2...+..%..G..2VGT^$9.dy..+j..?.

                                                                                                                                                                                                                                  Chrome Cache Entry: 661

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (8911), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):8911
                                                                                                                                                                                                                                  Entropy (8bit):5.656149570883809
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C6913DC67F057096C80C47789DDE82CE
                                                                                                                                                                                                                                  SHA1:668394A7A93E7CFDADED136CB9A624CC9DEA314C
                                                                                                                                                                                                                                  SHA-256:81E59351A38C79957F36EC7A7C2B260635732F28B41552337D96C77B417B46D3
                                                                                                                                                                                                                                  SHA-512:E51F13CFB3530F78D8598C57660711179AF849F12A30EC9D21F6064A2937FE0B199B83D9F539C93CCA8A032F45698A27DEA2C94014D7FA230307CAEFE4526E8A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://secure.livechatinc.com/customer/action/open_chat?license_id=1389892&group=3&embedded=1&widget_version=3&unique_groups=0
                                                                                                                                                                                                                                  Preview:<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"/><meta name="theme-color" content="#000000"/><meta name="google" value="notranslate"/><link rel="canonical" href="https://secure.livechatinc.com/"/><link rel="preconnect" href="https://cdn.livechatinc.com"/><link rel="preconnect" href="https://api.livechatinc.com"/><title>Contact us via LiveChat!</title><meta name="description" content="Have any questions? Talk with us directly using LiveChat."/><meta property="og:type" content="website"/><meta property="og:title" content="Contact us via LiveChat!"/><meta property="og:description" content="Have any questions? Talk with us directly using LiveChat."/><meta property="og:image" content="https://cdn.livechatinc.com/direct-link/livechat-chat-with-us.png"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:title" value="Contact us via LiveChat!"/><meta name="twitter:descripti

                                                                                                                                                                                                                                  Chrome Cache Entry: 665

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):68
                                                                                                                                                                                                                                  Entropy (8bit):4.200601260429725
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C4A2B870062C2BB98C500BC1526C0498
                                                                                                                                                                                                                                  SHA1:528666CCDB12997358077BC8FCDBFB6B825C7788
                                                                                                                                                                                                                                  SHA-256:2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
                                                                                                                                                                                                                                  SHA-512:2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://ade.clmbtech.com/uid/sync.htm?pid=13079&cuid=k-1oilFn7SFkuR3iGMtOHNqjTloLIu01iFT4zCPw
                                                                                                                                                                                                                                  Preview:.PNG........IHDR....................IDATx.c`...............IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 668

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2627), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2627
                                                                                                                                                                                                                                  Entropy (8bit):5.831607894210518
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BD67B5ADE6352DE6E8F4B54803F59C5E
                                                                                                                                                                                                                                  SHA1:B5114B0A2D08BA4850F16D3820E84F2CDEA9E718
                                                                                                                                                                                                                                  SHA-256:601743EB6BF4D83C9E7CACC4CE491CC165753EE26D48C55A58A7D16211E10993
                                                                                                                                                                                                                                  SHA-512:4C1BA7E09A7F5FC14826A61AA6BCCB15B41E9F593D695F2623D3C134597DDCD67AA5D9532D9E87234BB46768418779D8F841227F069A7A1579DC1A326E24BA33
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11113079898/?random=1713902771304&cv=11&fst=1713902771304&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 669

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):19
                                                                                                                                                                                                                                  Entropy (8bit):3.6818808028034042
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:595E88012A6521AAE3E12CBEBE76EB9E
                                                                                                                                                                                                                                  SHA1:DA3968197E7BF67AA45A77515B52BA2710C5FC34
                                                                                                                                                                                                                                  SHA-256:B16E15764B8BC06C5C3F9F19BC8B99FA48E7894AA5A6CCDAD65DA49BBF564793
                                                                                                                                                                                                                                  SHA-512:FD13C580D15CC5E8B87D97EAD633209930E00E85C113C776088E246B47F140EFE99BDF6AB02070677445DB65410F7E62EC23C71182F9F78E9D0E1B9F7FDA0DC3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:404 page not found.

                                                                                                                                                                                                                                  Chrome Cache Entry: 673

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 1920 x 520, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):114272
                                                                                                                                                                                                                                  Entropy (8bit):7.890762261986169
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7B7DE3CF2933DAF509923A62C69852A2
                                                                                                                                                                                                                                  SHA1:694D1DC1F06BAE43CD070585A1B85B699B665F4C
                                                                                                                                                                                                                                  SHA-256:A499823C4F61A21021C6B30928BD6260797BE399B791BA955A5C033B98BDACA7
                                                                                                                                                                                                                                  SHA-512:358FA9C74D15BC0637BA22D68F3965B5CCF12D908932DCB3EA86CE7E62C8C152DD524A2C2DA0DA4B168D07FAFC4CAEBD2820C3F52D998BCB838D8BC19D26367B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.....................PLTE.....................................................................................................................................................................................................................................................................................................................................................................{.....o...........h.....v..........._............................x..........|........................................\c.W......n......:Ka...OMi........O.....P......s.....*<w.....GD^2@[.......=;Q..i...'7N..................<H....+.........A..z....N..^...............o......K....~.....R^tjt.2.......C.....f....s..F...........B........kp.^.......z......e..X.1..mx.....N......{._.....L........IDATx..}O#U..Fk.D.bMI..&...BH.M.G.!..I...1..1..>.m....U1>.3s.StQ...s.~....|!:1!..-...$yuHG...MG+.7o..:..8.?...q...l..|..>.&..:}u........[.K.w.........=8.9W......wYT..c..1.2...

                                                                                                                                                                                                                                  Chrome Cache Entry: 675

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 44 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):579
                                                                                                                                                                                                                                  Entropy (8bit):7.560728711936546
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5D02A6500D959A598EE46E999315FBEB
                                                                                                                                                                                                                                  SHA1:F31CF4A10824CFECE15D81331DE7FE4D75485E04
                                                                                                                                                                                                                                  SHA-256:9C566EB03DDF664CC6E608F0BF825ABB51408C9DBCFD6ACA800287153BCBB7E0
                                                                                                                                                                                                                                  SHA-512:2246E556F6393B39765B87D4F9CF1D0A6FE71248E9B90A0ED38B369FAC266F1464462D80ECC61FF66690D84C83A158C94867CC0D5055488FEC7F3C34783DA5A8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...,..........o......IDATx....]A..O.....j#Nm.m.m[.......L....UW....3..p.F4......z.e.)('.U.+..d...b.T..J..T.+..G....S. U.a.......^..........X...*...$..W.W&}.s....?Of..}.....v...c.......k..c.a.i....u.L..kO@.Q.`.t...9....g..w.~....wh>Bj.o....:n#.p.....*......)Q.g.J..'...o........{.X....N..q....4.x..t..m.@.....4.j....l..Y..&.g..(....9UU......6...;.e*.\...wX.6.............^|...w].o>.I.%w...,pv..H.8!.._.Z.%..._...=."./?....O....3.*1..X.Z....{...ZN....Z....Bn....Y?......O........`....w.....;.....r!?.,..w.=...5..c..h.....j~.q.......IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 676

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2928), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2928
                                                                                                                                                                                                                                  Entropy (8bit):5.860921415638719
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A1B5C002C617FFEBFDB1F0FBB027B03A
                                                                                                                                                                                                                                  SHA1:E588BD96C871006FECC790F062F47C96F686EDCD
                                                                                                                                                                                                                                  SHA-256:BEE4B3DD9B22936D42D4685EA366EFC03AD9CE0418408982E693F676E499510D
                                                                                                                                                                                                                                  SHA-512:35B9EE1936A9CF452EC1DC4455BFB899D571B2214762F7308B9E35EE6A26C974873C161D5642470239D6CD1E3C1EBF7670DD55A35F7165F4EC09EB8A66859BC9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11113079898/?random=1713902813625&cv=11&fst=1713902813625&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 677

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 258 x 307, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):9307
                                                                                                                                                                                                                                  Entropy (8bit):7.91731212794537
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:85822F06A30BD39263AE5B8CFE53E3B8
                                                                                                                                                                                                                                  SHA1:EC34A2B5D048C8D2A220FFE4BEE50C366885F987
                                                                                                                                                                                                                                  SHA-256:33CB1A46CBB9335831D68EF8C20043FF53810538B73EF577DD4724B3F19C5677
                                                                                                                                                                                                                                  SHA-512:0E4D5C235886374937FE45C59DA2922E777F176595C36A307237075410F45E8E98C92A2D1CD31F9F1A1B2423F07DCC46E1BE78511B70AB34920721A3D5837535
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.......3.......j....PLTE................................................................................................`m~.........).....Uaq.....................7....7..S`p6..:........9..iv..../.....5..Vcs3..6....T_o...4..O......~..A..S_o......L........S_p.....#.........O...T............o}..................o..n|.h........E..T`p......9..............g....................q..............Rh.!...............x.S.....V....."..... ..~........Oe.Mc....'.............. .....J........................................................".............%.....................9....l...........b..s......$Dkw.@M^KVf7@R-5C]s.!&,O......y..%~......D....:..Wl.0..@..d{.}.....Ydwan.........x..X..=........u.....g..[.....+.......V.....;....'q....a..I....0.......Aw.#.....itRNS.......... )1.&."+47.$:>A<E.+..5.~.^M!....`.....5...R9M...x._.....xp.oZ.....>......6.I....xo...._..... .IDATx....j.X..._....Q..:..-...........,....7.U%...Gh.....A.......f3.

                                                                                                                                                                                                                                  Chrome Cache Entry: 680

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 72 x 72, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):502
                                                                                                                                                                                                                                  Entropy (8bit):7.3833399324827536
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8E2CE33DB6F19A7AF587A60543F4500B
                                                                                                                                                                                                                                  SHA1:358438F2E3A8140E2FC7FDD03A5CF7E7812BA3FE
                                                                                                                                                                                                                                  SHA-256:E32A972EEDE6B6D6C0FEB80915E441765669A18759F8CDF4C827C3EB3FEC5ECE
                                                                                                                                                                                                                                  SHA-512:CEFA2C4B3B499401716FC0C4DD05414945139F4E2A65A8D4EA31049EA59ED20FD82AF9B4F774C097E91D24A0985E3C3593C0FAA49B60F70564A0D732D2D29B28
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...H.....b3Cu...$PLTE...K.....s..-.........................^t....IDATx...[.. ..P......;.*........|F...GZ.....9}..U.!.KIn....Z..1....6.r..#Y..=i..*.AP._i-*...j..&9(.m..9n.Q..4...:.<.3.D..F.......a..V.a.v6.FPX...a..X9.0*..0..bG.....o...bJ..........4.....q.V.c..m.`.6........eu.x.... .AJ..~P.A.....T&P;.g.18......WD&H..q..B...j?...>...lf..J'||m..)._.X;.<>h.H.bL.$..^I.G.X..ji....k?.L6..<S......I...6@..}.x..D....aZ.YNcj.G.o.`\...8hO.........v.....:W3B......IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 681

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (703), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):703
                                                                                                                                                                                                                                  Entropy (8bit):5.326234611665612
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:750DF438450878ABB77A6018C3FA557F
                                                                                                                                                                                                                                  SHA1:1F9FE8C4B812A00A32A3F9861670B8B7286BC3B8
                                                                                                                                                                                                                                  SHA-256:EA19C4DD010214C1C7C58470DC84134E45FF28575182C21B9CDCD29B0112A447
                                                                                                                                                                                                                                  SHA-512:A28BEC2F145243C6C22F44DDFF5F04CF7E2D619B881AFFCEE63DF79A747BBB542A260F21333F2D592CFD5ADFCEDCF0C5F021B40637966B3EF6AF7898F8F058EC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/js/cj.js
                                                                                                                                                                                                                                  Preview:"use strict";$(function(){var e,t,c,s,a=document.URL;if(/^https/.test(a)){var o="390467271471";/^.*?\.easeus\.de/.test(a)?o="390466647600":/^.*?\.easeus\.fr/.test(a)?o="390466765032":/^.*?\.easeus\.co\.kr/.test(a)&&(o="390467184579");a=document.URL.replace(/(^http.*?\/\/.*?\/).*/,"$1");e=a+"proxydirectory/tags/"+o+"/tag.js",c="script",(s=(t=document).createElement(c)).src=e,s.type="text/java"+c,s.async=!0,s.id="cjapitag",(e=t.getElementsByTagName(c)[0]).parentNode.insertBefore(s,e);var r=globleJs.GET("cjevent"),n="domain="+document.URL.replace(/http.*?\./,".").replace(/\/.*/,"");r&&(r=r.toLocaleLowerCase(),cookie.setcookie("cje",r,9480,!1,n,!0),cookie.setcookie("cjevent_sc",r,9480,!1,n,!0))}});

                                                                                                                                                                                                                                  Chrome Cache Entry: 682

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (5140)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):67633
                                                                                                                                                                                                                                  Entropy (8bit):5.338567957373203
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0223F1F2DA46E0B5719F6199B4A776F9
                                                                                                                                                                                                                                  SHA1:B635F610CB52A24CA644E593A72A55DD9555A8E7
                                                                                                                                                                                                                                  SHA-256:AD2A19391E833845D1C192591D65543DCF7F4C313DEF405AEF4A85598B4A467C
                                                                                                                                                                                                                                  SHA-512:E87609BDD8354343ACA8C09498B7050C4E77844801B0AFB224B4117D39D8C2A1A6AA34A8F26E1CB2348C2F54B1C1F6D76EBBD2D6009D3A44C2A5194F6E60DB9E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://connect.facebook.net/signals/config/239496765217947?v=2.9.154&r=stable&domain=www.easeus.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105
                                                                                                                                                                                                                                  Preview:/**.* Copyright (c) 2017-present, Facebook, Inc. All rights reserved..*.* You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook..*.* As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software..*.* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

                                                                                                                                                                                                                                  Chrome Cache Entry: 684

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 1920 x 550, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):16822
                                                                                                                                                                                                                                  Entropy (8bit):7.891129248336187
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A093B0B3BFAE08D61642AAC7D4A96AAE
                                                                                                                                                                                                                                  SHA1:9D4A610E701044D40A1B55276687C4C6445F37E1
                                                                                                                                                                                                                                  SHA-256:081DE6888AC3E085250F8960D418111955A3351CDB41EEA7C571DD4327DF93DE
                                                                                                                                                                                                                                  SHA-512:849AB019028AF4A681BB37842172FF9F7E230A867AAA8771859D6E35568E37862FE0D6E5B53C81EF56501E2BC950E9A51B0F1E8A9409361CB6243EA53CF0316E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.......&.......g....KPLTE..-..0../.$5.,<.(8.!2.2@.7D.dj.OX.lp.GR.=I.BN.hm.W_.S\.^e.os.[b.KU.ag.rv.z|.F...A&IDATx...K..0.@Qu.....g.+M.......I.{f...Z.....E....MM..").j.Z....../NrS...J.......JS..Z.MM..H..b......(N%n.*.JMT.H..M> ....T.....4.'..yUr ...s.'x.^2Q.S...Fc3.W.| .....'......H;..#.........$*qvm.$.&j.u..l.|C...W.Op.F9..o..|3.W+B...W.O.....u.|....i{y....d......n.....Z.%.....?..S<.V51..K.T?ZG.....O......v.J.4v.......B.7.2...H....JT..U............C%.~l"..N>F...`...S..;.#..2...`...;..2...nM&J....O%..S.....y...`...;w%.O.w......J\..T{'Wg.S%......UM......)B.0...UuS......f.}7.b....r.o..yo.a[.&...g.'.6.e.......F_<....._..l................7...C...v.e..u.h....|RJ...Ii..Z.Z..5.?.7....;..C=.....J....h.W.j......:.v..xq........~..0U..%...44..V.gc.....N........q.?..h.sS+.<%....4.&..../.s..G.6,.d...x.<.p.,.b....%....T.wq......S\Ij....,7..~...}...J..._...Ha ..._..h.....t....h.......Q.T....U.VY...l}(...k2..A.y.......x..l-.............z.&....=....

                                                                                                                                                                                                                                  Chrome Cache Entry: 688

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 176 x 121, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):5665
                                                                                                                                                                                                                                  Entropy (8bit):7.789483783515542
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DFE9655E355B18E974F6ECEBEDF80F4C
                                                                                                                                                                                                                                  SHA1:D78DA71808CCE59FB408743EBC459AFF61E047C6
                                                                                                                                                                                                                                  SHA-256:59805425C06693A44B2635086F8D9747B31F884CBECFB0D655AB46FAA8394C54
                                                                                                                                                                                                                                  SHA-512:A8BD03869314699C4DE417EDD3EC4E07C4D631123565A6E5D27BD27899189207E62C9ABC3210599E7B0B8C745D8E2D9DAEAD23BF77716CD65BFD21B6FBE0C143
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.......y.......[.....PLTE..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+.&U....tRNS......._....I$}.#..P..'..4..M.qn+.VM?=.~{Z.......t`:7.............a9......mHG<-.............ushZQE21+!...................xkhSMA?5*................_PB,#........|idc\XVE9%.......

                                                                                                                                                                                                                                  Chrome Cache Entry: 689

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (11209), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):11237
                                                                                                                                                                                                                                  Entropy (8bit):4.3912898156702616
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9AF5EBA54DAE24F8AD806A892C47CD56
                                                                                                                                                                                                                                  SHA1:C9E69255C61817C99B1280CDF6B39AC7A3DB5DDB
                                                                                                                                                                                                                                  SHA-256:8C6B4381DA30DF440C09503F0387A1A61EB06C6B06DAFA3942299D6E944C7FF8
                                                                                                                                                                                                                                  SHA-512:2F4C7655FAF8DAA9148F6D0ABC7989D5C4ADF0AFECDF4B312CB04B491A7C786FFD325FAD93740433564C88D5173BC27D96C050A50B6A2F9506BBDF7C19E55A09
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/campaign/2023/11-27/animate/12/data.json
                                                                                                                                                                                                                                  Preview:{"v":"5.9.4","fr":30,"ip":0,"op":120,"w":130,"h":70,"nm":"new-year","ddd":0,"assets":[{"id":"image_0","w":9,"h":9,"u":"images/","p":"img_0.png","e":0},{"id":"image_1","w":20,"h":34,"u":"images/","p":"img_1.png","e":0},{"id":"image_2","w":22,"h":17,"u":"images/","p":"img_2.png","e":0},{"id":"image_3","w":26,"h":20,"u":"images/","p":"img_3.png","e":0},{"id":"image_4","w":38,"h":28,"u":"images/","p":"img_4.png","e":0},{"id":"image_5","w":20,"h":21,"u":"images/","p":"img_5.png","e":0},{"id":"image_6","w":17,"h":31,"u":"images/","p":"img_6.png","e":0},{"id":"image_7","w":110,"h":70,"u":"images/","p":"img_7.png","e":0}],"layers":[{"ddd":0,"ind":1,"ty":2,"nm":"fire.png","cl":"png","refId":"image_0","sr":1,"ks":{"o":{"a":1,"k":[{"i":{"x":[0.667],"y":[1]},"o":{"x":[0.333],"y":[0]},"t":20,"s":[100]},{"t":25,"s":[0]}],"ix":11},"r":{"a":0,"k":0,"ix":10},"p":{"a":1,"k":[{"i":{"x":0.667,"y":1},"o":{"x":0.333,"y":0},"t":0,"s":[75.5,62.5,0],"to":[-0.537,-0.613,0],"ti":[1.846,1.977,0]},{"i":{"x":0.667,

                                                                                                                                                                                                                                  Chrome Cache Entry: 693

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):4286
                                                                                                                                                                                                                                  Entropy (8bit):4.189513611296472
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DD4E2BA2D805AD81A3175C464589ACEB
                                                                                                                                                                                                                                  SHA1:9E9B8360DBC709DBCA37385A8784E19B4EC58F91
                                                                                                                                                                                                                                  SHA-256:AD8BC6C01299B96217FE9B66D7A646E7E20CD67EBE01EB7188DE5078B54B655F
                                                                                                                                                                                                                                  SHA-512:48F2947AE30CAB5FF4C4FCADC0BD89874EC7411A47E30A1BFDBE4A7FEFCF1C43F455F89D6BF9ADDBC22F567B58DEB167F794AAC6DA2B9D455933F16C3CC264CA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/fav.ico
                                                                                                                                                                                                                                  Preview:...... .... .........(... ...@..... ..............................................................z.........Y...[...=.... .......?z...............................................................................................|.........................M.........~......................................................................................"...!..............................f............................................................................................%.......!..........7...................8.....w..................................................................................,...!}.................................k.............................................................................`..._...X...e...g...f.............|..............._%................................................................f...e...f...c...f...i...c...h...g...q]............................. ....~...j...............................................`...]...d...g...g...g...g...j...h...g

                                                                                                                                                                                                                                  Chrome Cache Entry: 694

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (12370)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):315130
                                                                                                                                                                                                                                  Entropy (8bit):5.571631620873903
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C6B970D2318DA1ACF687A60DFBE25025
                                                                                                                                                                                                                                  SHA1:0F00BC22F04685C94E2ADA752F89A681E974DADC
                                                                                                                                                                                                                                  SHA-256:00EAE313477E05ABEA0F9D3A796629265528AEEA43D16DB8CF0AA6BFDAD9D666
                                                                                                                                                                                                                                  SHA-512:A1C5D1F14F2CE33F58B567AD751D585C2D3A078D2FF1B7BE3AB6992E9C1651D0B09951C42D59583BF3B3360113CD407BC2CD34326B181BBC90CB4A2C0224210B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.googletagmanager.com/gtag/js?id=G-9ETQKR539E&l=dataLayer&cx=c
                                                                                                                                                                                                                                  Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"17",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"function":"__c","vtp_value":false},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":31,"tag_id":116},{"function":"__ogt_referral_exclusion","priority":21,"vtp_includeConditions":["list","buy\\.easeus\\.com","order\\.easeus\\.com","order\\.mycommerce\\.com"],"tag_id":118},{"function":"__ogt_ga_send","priority":21,"vtp_value":true,"tag_id":119},{"function":"__ogt_ip_mark","priority":21,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",4],"vtp_enableIpRegex":true,"tag_id":120},{"function":"__ogt_session_timeout","priority":21,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":121},

                                                                                                                                                                                                                                  Chrome Cache Entry: 695

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (62292), with CRLF line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):62389
                                                                                                                                                                                                                                  Entropy (8bit):5.353636010965601
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:30B9882CF93F4A9B2FFA96AB351271D8
                                                                                                                                                                                                                                  SHA1:970340E440846513D7BA29BAF27795A042C96AA8
                                                                                                                                                                                                                                  SHA-256:D6F3A8301FFA9A9AA6A748CCC535A559242CD73451BB4D236B7E72FF64123703
                                                                                                                                                                                                                                  SHA-512:D6B4041CD68701C94C876259A947831C677902789AC1C4D13B71CD3F47C8FF96B02240681D372D10A74D102E32DC7837F0C633F0A4B28A560CF5F3C11BF8EECF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.clarity.ms/s/0.7.31/clarity.js
                                                                                                                                                                                                                                  Preview:/* clarity-js v0.7.31: https://github.com/microsoft/clarity (License: MIT) */..!function(){"use strict";var t=Object.freeze({__proto__:null,get queue(){return Ua},get start(){return qa},get stop(){return Fa},get track(){return Ha}}),e=Object.freeze({__proto__:null,get clone(){return fr},get compute(){return hr},get data(){return rr},get keys(){return ir},get reset(){return pr},get start(){return lr},get stop(){return gr},get trigger(){return dr},get update(){return vr}}),n=Object.freeze({__proto__:null,get check(){return Er},get compute(){return Nr},get data(){return ar},get start(){return kr},get stop(){return Tr},get trigger(){return Or}}),a=Object.freeze({__proto__:null,get compute(){return Cr},get data(){return Sr},get log(){return Ir},get reset(){return Dr},get start(){return Mr},get stop(){return _r},get updates(){return xr}}),r=Object.freeze({__proto__:null,get callbacks(){return jr},get clear(){return Yr},get consent(){return Xr},get data(){return Ar},get electron(){return Rr},

                                                                                                                                                                                                                                  Chrome Cache Entry: 696

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 text, with very long lines (579)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):30207
                                                                                                                                                                                                                                  Entropy (8bit):5.358799789516591
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4E85A3741409B723EFA831C2E8BB1CAF
                                                                                                                                                                                                                                  SHA1:6006E6C3491D952DA045111EA5F9F9203371CCEF
                                                                                                                                                                                                                                  SHA-256:84A931BDCBB578BE2E8E588FF66924227F5CA02CC7A9581303FF0D306A62FB9B
                                                                                                                                                                                                                                  SHA-512:76D7799FA28117E985A728BF5ADD2B43B00085071966D46F7CFE740ADB570586F5D540E19D7377CAA8C963915FCE4001C3DB93CA6A24B75644FA0938625C0839
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<style>..download_pop_new2_showhtml{position:fixed;left:0px;top:0px;width:100%;height:100%;z-index:1000; display:none;}..download_pop_new2_showhtml .close{display:block;position:absolute;right:-52px;top:-30px;width:40px;height:40px;line-height: 40px; cursor:pointer;z-index:999; color:#fff; text-align:center; font-size:32px;}..download_pop_new2_showhtml .bg{background:#000;-webkit-opacity:0.6;-moz-opacity:0.6;opacity:0.6;filter:alpha(opacity=60);width:100%;height:100%;}..download_pop_new2_showhtml .content{position:absolute;left:50%;top:50%;margin:-340px 0 0 -409px;background:#ffffff;padding-bottom:20px; width:750px; border-radius:5px;}..download_pop_new2_showhtml .title{background:#eeeeee;font-size:20px;padding:20px 0;text-align:center; color:#2f2f2f; border-radius:5px 5px 0 0; margin-bottom:30px; position:relative;}..download_pop_new2_showhtml .title font{color:#0083e8;}..download_pop_new2_showhtml .title .img { position:absolute; bottom:-20px; right:60px; width:28px; height:51px; dis

                                                                                                                                                                                                                                  Chrome Cache Entry: 698

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):93222
                                                                                                                                                                                                                                  Entropy (8bit):5.5426975007430865
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DCA9B86236651E2FAC686D09D2348CEE
                                                                                                                                                                                                                                  SHA1:BC6BED7E43489A4C42C520AD615315B5CAE2A2C5
                                                                                                                                                                                                                                  SHA-256:8F744CBD5A5F8E4783529C687997D30E463286F3F28A1650334FF5641EA21006
                                                                                                                                                                                                                                  SHA-512:92E0656F3C9F3DC7F8BCFE635B05AFE5FC8016EA22279BB359ECD9098A50770EB4CDC91B2E95E8ACCCD009B403DEA8890398A2CAAAE90DCAEBFA805F683B32AA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://td.doubleclick.net/td/rul/1064956115?random=1713902771290&cv=11&fst=1713902771290&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
                                                                                                                                                                                                                                  Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j689129974"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j691334967"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j797471435"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j797761798"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7572346854"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7589463467"}},{"action":1,"interestGroupAttributes":{"owner":"https

                                                                                                                                                                                                                                  Chrome Cache Entry: 700

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):434
                                                                                                                                                                                                                                  Entropy (8bit):7.388424433151624
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:ADD78293EE00ECB5EC17B9883ED85363
                                                                                                                                                                                                                                  SHA1:EF991B193AD31DCFEDA42BD27C497C3115BF3921
                                                                                                                                                                                                                                  SHA-256:50F70CB1D280C43BEC9F932C5FC0A544DCCAE446FB11A495698380AF65E311E8
                                                                                                                                                                                                                                  SHA-512:EB7175D34D3B74C52215268791F39BC1E59F8DE5402F696EAD34B98EB0F71958CDE339B60D78141EB7EF1F3ECAE5714034244BE0CB25DA75D6CA9DC4D6AFD4BA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/index/nav_win11_icon.png
                                                                                                                                                                                                                                  Preview:RIFF....WEBPVP8L..../+.....m$I.....?.....IR.Z...}.AOe.?.H..t..@.@...#..!....Z.#.Z...?1..(..........dm./...B...B2....Hr..I.Y$....b...... ...dJ.....<7.......}.,I... ........e.......m.....W..#...m#E^.=x..wA..6.3.>-...I...d....Q.J....C.^..~..Y*...v....[dv.x8=x.Kb.{.....U9..>.a..=....}F...f[....L.AY.=..m|....E.icn..&....j....,...7N...&Jg....nSHm.&.Ohp.+,..dr..B..'.h;F..z...H.-.?...?.....j4...........Y...j.A.

                                                                                                                                                                                                                                  Chrome Cache Entry: 701

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (14301)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):14613
                                                                                                                                                                                                                                  Entropy (8bit):5.42072136912928
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:120B4FD6B9D87E3DEE1FD71FF82137B7
                                                                                                                                                                                                                                  SHA1:D86A86A69AB7477F25377E253242D305DA6493D2
                                                                                                                                                                                                                                  SHA-256:9F5B814F698DA2F9AF4DD56034A54C48E457EC1F1301828769FAFC493062D9F1
                                                                                                                                                                                                                                  SHA-512:3692A96DF177DE54FEF873130EF2CB2A6946F41AA3D4DC77A48C296975C02623FC43E26FE2AE22A134F7FF62BBA08C63B78DEADC034D0D9242576BF09B98CD3D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://gum.criteo.com/syncframe?topUrl=www.easeus.com&origin=onetag&us_privacy=1---
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>.<html>.<head>. <script type="text/javascript">. window.CONFIG_CSM_DOMAIN_NAME = "csm.us5.us.criteo.net";. window.CONFIG_CSM_RATIO = 100;. window.GUM_DOMAIN = "gum.criteo.com";. </script>. <script type="text/javascript">. !function(){"use strict";var i=function(t,e){return(i=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}||function(t,e){for(var n in e)e.hasOwnProperty(n)&&(t[n]=e[n])})(t,e)};function t(t,e){function n(){this.constructor=t}i(t,e),t.prototype=null===e?Object.create(e):(n.prototype=e.prototype,new n)}var e=function(){return(e=Object.assign||function(t){for(var e,n=1,i=arguments.length;n<i;n++)for(var o in e=arguments[n])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t}).apply(this,arguments)};function n(r,s,a,l){return new(a=a||Promise)(function(t,e){function n(t){try{o(l.next(t))}catch(t){e(t)}}function i(t){try{o(l.throw(t))}catch(t){e(t)}}function o(e){e.done?t(e.valu

                                                                                                                                                                                                                                  Chrome Cache Entry: 702

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (64347)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):223683
                                                                                                                                                                                                                                  Entropy (8bit):5.454805360153245
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:85F41014BE15CC3E54A4123C00C5021E
                                                                                                                                                                                                                                  SHA1:1E5468F507A8B0216114A8D8F63309BE8CBCAB9F
                                                                                                                                                                                                                                  SHA-256:01E9582655224C83E6C075F44B7EECB135E108B6AD2150BF6F78A0A77C4AD5E0
                                                                                                                                                                                                                                  SHA-512:78F6D6CD922AA42FD340CF215D7D91DDFABEF5EC393DFA5EB578436B9B668F839747218A4DE980AEC2395194667B1E0215623EC902EAAF8CE592536172414FCD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://connect.facebook.net/en_US/fbevents.js
                                                                                                                                                                                                                                  Preview:/**.* Copyright (c) 2017-present, Facebook, Inc. All rights reserved..*.* You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook..*.* As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software..*.* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

                                                                                                                                                                                                                                  Chrome Cache Entry: 708

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):43
                                                                                                                                                                                                                                  Entropy (8bit):2.9674235276304235
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6F81C41597D3F5A336F458822CC0C32A
                                                                                                                                                                                                                                  SHA1:8CD77A54B38F1FB376B45AF2EAAB8F5982523B8D
                                                                                                                                                                                                                                  SHA-256:5704A2E9F2F7CE43A79F9B407F1AEDCFD50223CBE8BD2F71FF8C5C819E469CBC
                                                                                                                                                                                                                                  SHA-512:EDB4841FA021F06B664C4F09378F6572177CEB8518B976C0B1571E2346FA116097D4979D31BD9AB7E841B68795922A07D451583620A2F31E3E54A867F91D7C95
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.consentmanager.net/delivery/alertdomain/d184NTAxNy5zXzEuZF9pZHN5bmNfcmxjZG5fY29t.gif?ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F
                                                                                                                                                                                                                                  Preview:GIF89a.............!.......,...........D..;

                                                                                                                                                                                                                                  Chrome Cache Entry: 713

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 275x210, components 3
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):14846
                                                                                                                                                                                                                                  Entropy (8bit):7.962841182093763
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:ABD72B2284C5F8C730988FFC0A273127
                                                                                                                                                                                                                                  SHA1:FE47DB1C454861A54CEAB32A758EE1155381CE25
                                                                                                                                                                                                                                  SHA-256:C34585E49E812F5C9048E3A201A530CA23D5D0DA699BFD29425E08A3393E08D5
                                                                                                                                                                                                                                  SHA-512:DB6D8E6212E393D5BB419B2A3A388962DF44506646CE2D4917E82088837D151CC58D03171E67B03881BB30E43A2AA05DA2CDAD9D02FA034F4A6D4240AE6AD260
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}...........".................................................ck.^......G....\...M....5...."r...P.v"Y..a..+.%.<..w%\.AU8Z..xF~h..m...'......}|.(. .Ye.rH.R.(.${(...D.._.....<...*NIn..L,.1)..............s....6..~...0X....u"R>.....H...A..t...>.}tT...........*E..)..(....h3......{m.I.....;t..R....3o.M..'b.`....t..... .M....l..sM8.[dVC.o<#.,..RA..L.wS...<._38....z.m...aQ.G^.....koWS.3.5.T..c"..A.0@...@....v.G.p1..}.<.My...V.g.)tX..O"%n2....R.]}...Z.._>........./...>.1.........~Q8.k.a,`=~...~.....c...6.....?A.........O$h..n.m.OL'....a{T....m+.e..)..9....{.c..P=..l......?.....AN|.%:c!/..:..5rD.2.K....o.......n.v....4.j..`..'D...F.E.9...R.%...v.._5.a*<.....b..:|....)...z.r.7S.5cB..^...s6......k..f$.^.u..~j.x...b.+.d...^tU.1,..g.O.h....D.5...e...X7.(y.>....V...Y.../....T..[BU...xE...[..)....(....D........@

                                                                                                                                                                                                                                  Chrome Cache Entry: 716

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65462)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):214663
                                                                                                                                                                                                                                  Entropy (8bit):5.343586314852058
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:01CF65BD25484EE1F4279B0B280A3DCD
                                                                                                                                                                                                                                  SHA1:168810F12DD5E87040F0BB249F073E11BBB29AF5
                                                                                                                                                                                                                                  SHA-256:75060A4E7D446728CC58BF2D672D0FEAAB5C76D87F4A1A6E7C1312E2D6C6B0ED
                                                                                                                                                                                                                                  SHA-512:D8A2B74E72DB23B624FD48911C1ADD99C635DDCBCC296B23B8F2D610169439A4144B1EE449A4C8429F1B67C5651A578C1612BF3EC062400F95DECE117511C58A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.livechatinc.com/widget/static/js/0.ab0f66ca.chunk.js
                                                                                                                                                                                                                                  Preview:/*! For license information please see 0.ab0f66ca.chunk.js.LICENSE.txt */.(this["webpackJsonp@livechat/chat-widget"]=this["webpackJsonp@livechat/chat-widget"]||[]).push([[0],{0:function(e,t,n){"use strict";e.exports=n(467)},1:function(e,t,n){"use strict";function r(){return(r=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e}).apply(this,arguments)}n.d(t,"a",(function(){return r}))},101:function(e,t){e.exports=function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];for(var r=t[0],o=1,a=t.length;o<a;o++)r=t[o](r);return r}},110:function(e,t){e.exports=function(){var e=[];return function(t,n){if(0===t){var r=n;e.push(r),r(0,(function(t){if(2===t){var n=e.indexOf(r);n>-1&&e.splice(n,1)}}))}else for(var o,a=e.slice(0),i=0,u=a.length;i<u;i++)o=a[i],e.indexOf(o)>-1&&o(t,n)}}},12:function(e,t,n){"use strict";function r(e,t){return t||(t=e.slice(0)),e.raw=t,

                                                                                                                                                                                                                                  Chrome Cache Entry: 717

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):43
                                                                                                                                                                                                                                  Entropy (8bit):3.0950611313667666
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AD4B0F606E0F8465BC4C4C170B37E1A3
                                                                                                                                                                                                                                  SHA1:50B30FD5F87C85FE5CBA2635CB83316CA71250D7
                                                                                                                                                                                                                                  SHA-256:CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
                                                                                                                                                                                                                                  SHA-512:EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://rtg.prdredir.com/sync?ref=&lp=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&sh=1024&sw=1280&date=1713902767389&fp=uid-9128419718.2900516408
                                                                                                                                                                                                                                  Preview:GIF89a.............!.......,...........L..;

                                                                                                                                                                                                                                  Chrome Cache Entry: 721

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1136)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1596
                                                                                                                                                                                                                                  Entropy (8bit):5.265195860829847
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:12F81FA3B5E267ADA0B2376A035B5C49
                                                                                                                                                                                                                                  SHA1:DC1FB95A120B76FEEA537CD4B2CD1BA507DB5B5B
                                                                                                                                                                                                                                  SHA-256:8CB6448894FADD9C8A6BAACFA8F4C096B1DD46B2BC712F1E09F8575E62C3AFB8
                                                                                                                                                                                                                                  SHA-512:4E45A10CC2922FE1E1449722D1987C00A0543E2497487F50A5F60323199C83557A5E4C856E171F3886ACAE99023BF4B0BD6CFF1D9597D3A290E4C97E69884C24
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.

                                                                                                                                                                                                                                  Chrome Cache Entry: 723

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2920), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2920
                                                                                                                                                                                                                                  Entropy (8bit):5.85877801941125
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3F9589FC69A329DA0A2227BD110A76C7
                                                                                                                                                                                                                                  SHA1:4D265E1217ECA466CEF40E94A50CE6FD4BF518E0
                                                                                                                                                                                                                                  SHA-256:828563820F31A3D61E1326FBD75CEFEB56BF3D4C11BFD32556138CE1C7AC2E41
                                                                                                                                                                                                                                  SHA-512:5D9BA4A27AA05A615A7EC6E1F368B5563830CC6A64E11A26D8D23E98DC429E52BCED533F88B0FC197FEF37FD454EBA5CA21BA7F4E5819D080B4337977002E77D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11113079898/?random=1713902825625&cv=11&fst=1713902825625&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 724

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (10479), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):10479
                                                                                                                                                                                                                                  Entropy (8bit):5.298301629120444
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D7F07563F5207EDD1E69E9EFA2CE7ED0
                                                                                                                                                                                                                                  SHA1:253848E5037B8FD0BD304CE4A4A08CCC261F0C5B
                                                                                                                                                                                                                                  SHA-256:1D6B4FFB0724F56B205B14EF240B5A08FB3DD5A8B6F2C3710570A31AF7828327
                                                                                                                                                                                                                                  SHA-512:C3FB7C26C32442B84AFB467CD0CE3BFFC8D876DACCC5AE789D80E132EC0DBE89F73C3A7A02B9898E54E24614CF468225237DD5E8418417E4B1B8BCC8EAA77710
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/js/questionnaire.js
                                                                                                                                                                                                                                  Preview:"use strict";$(function(){function n(t){var i={timestamp:Math.floor((new Date).getTime()/1e3),web_app_key:"questionnaire"},n=function(t){var i=[];for(var n in t=t||[])i.push({name:n,value:t[n]});i.push({name:"key",value:"dz3li91372vstwzd"});var e=i.sort(globleJs.sort_compare("name","asc")),s=[];for(var a in e)s.push(e[a].name+"="+e[a].value);return s.join("")}(i);for(var e in t.data)i[e]=t.data[e];globleJs.load_script("https://www.easeus.com/default/js/tool/sha1.min.js",function(){i.sign=hex_sha1(n),t.data=i,t.timeout=6e4,t.url="https://mail.easeus.com"+t.url,$.ajax(t)})}(new function(){this.id=globleJs.GET("questionId"),this.url=document.URL.replace(/[?#].*|index.html?.*/,""),this.from_type=ispc?1:2,this.current_data="",this.cookie_name="questionnaire_20221025",this.init=function(){this.get_data()},this.data_html={1:'<style>\n\t\t\t\t.questionnaire_bg_20221025{display:none;}\n\t\t\t\t.questionnaire_20221025{background:linear-gradient(180deg, #DFEBFF 0%,#fff 30%,#fff 100%);border-radiu

                                                                                                                                                                                                                                  Chrome Cache Entry: 726

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 50970
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):15571
                                                                                                                                                                                                                                  Entropy (8bit):7.98254508678977
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F90DAF8C8F47C6AFAB7D4E27466118B5
                                                                                                                                                                                                                                  SHA1:C4CCE50F1E6DE0968CF0697DF2CED2CBE00C292E
                                                                                                                                                                                                                                  SHA-256:2874BF6C90CEABE51494D06C9F9009D7D3C2031A4AB6AE7C15503DA2DCE40761
                                                                                                                                                                                                                                  SHA-512:161FF33EA23148A0FCF9FF275716407E44C9732B1E4A8E1941C62AFB36F5C6972C8CCFC123F8232D8E8DA42C6E547A587540CFF6B8E40FFD25D96A650225FC6E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/main.js
                                                                                                                                                                                                                                  Preview:...........}.v.F.....4...h......q'...I&Nr.D...........dE.Z. .&.c.e^`^a......T|K.g...6P(.e.|{.........|....G.02#..j\..~....e....*..:)G.LSU....J..Q...:+........\/.z]...>.t*_...,..eq3.gyz3..,.r.=O.G.Y..]...*.=.......X.3..7....._..../....hF..g4..]...(.jz...4.S..'..87.#CMb....Uc.k...g....1r.}.4..6.6...n.1j...].c.3.(}...4...G...^.......l.w.....Q..~...tT.e6..#.U.t....\W.U.*.C.|S.....ezS.?O..<[..CA..0..*..A.Q....*.tc..o..lU.......uZ.............j....q.?..UqQ....4.(..f.a..g5..#.-...R...z....."=O.z.n6.)o......^$.b...N...,...O..,5.$U...N..7.......E1__.ym^......?..j1...M.@..L......[..,...:}.J.J...8....tY...Y....ru....."..n.q6.S.&.....r..tC;.r..o.U.c._.uV.B(K3__.I.o.K....2.NV....Ey5/ ....$... R.V.?.N.I)Z.<.o..Z.\..1MxL.T..M...eR....q`.......c&e.WiY..=.J..2..R'm.O+3/d.=.?/........'.o..In. ...t1..=.2.2.....*..$V.H4.q.e.%..8o*.@..1.q.]},z.E.........\..8.V.*j.:....?..ia...j......e........PCsU..kQ\..o!..V..&]<~<...%..,.@..q...hynt}CBy5..b.C}.

                                                                                                                                                                                                                                  Chrome Cache Entry: 727

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 286 x 242, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):12026
                                                                                                                                                                                                                                  Entropy (8bit):7.942914075475262
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:71B94679F227F77CD784CC03EF5222CC
                                                                                                                                                                                                                                  SHA1:BA210AA3792C9C8FD9BA4DDBA2D561484330BDE9
                                                                                                                                                                                                                                  SHA-256:8827319779A68AD305FBED9ADEE29C175FE90D57A74EE7E0F8E848DAD02B6D0C
                                                                                                                                                                                                                                  SHA-512:44F09C73324753385BB8A583A98F1867D52631E83217417ED08E2B01AA7AF53B166773A7A24B7D683EBD0D04142A5C4AAAE0CFE7EE765DE273A8D60887380CC3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...............Z.....PLTE.......................................l..............v.....s.....}.....`..2......{...l..|.....y..Z..h.....J..9..%..\..1....S..g..%...$5.....}...-..(..,........V...f.......#0;.......Tk...&((.9=V....^..i...I...Uavl...t...f........@Y.<S.7N.D^.Id..........Ut.....#........'..........Qn.-A.Mi;...*=....&8=...1E..........4I...:.....B..\..d..G..R..l.... :........... ..#...x.._}9..6..9.....~.....3..)......g.&..y...o.u..1........H..K..+....8..F........S..g..c..8..k..p....._..7......((A.....I..u..&.....6..H.....D..-..4.....6..(....."..C../.._.......Y..2..P....#UV ..*.....h......s.+..3..........1..%....rK..#....i..=G..m.. ..P.....J...tw.DH^........l..ac/...Zm..(..+G...11O......QV...9..B.......N/..,....k..],|.7..!..............g..%........'...........x....Sp...NtRNS......!G)>0P7.gp{_.Y..L.. 7.Y..YA.T....f...U......z..M.....W..f.o@....o..........+^IDATx..Mh.G.....ea...K...XA........./H..r.!.!..^....W."z1.@v...X...q..>.`.a)..16..K..L.D'..K

                                                                                                                                                                                                                                  Chrome Cache Entry: 729

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):881
                                                                                                                                                                                                                                  Entropy (8bit):4.8774930515734365
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:779D03A09D8331742A85AF252B3358E6
                                                                                                                                                                                                                                  SHA1:BAA1ACE7FE7F489B28A73A1342B1C64469ECB0CD
                                                                                                                                                                                                                                  SHA-256:B71F9F4D6BA2F5C9D9CEA87EC33DC7D9AA61B7812A13EFAB1ABA031C2E480E91
                                                                                                                                                                                                                                  SHA-512:F2095B64770CA70C370D563C4C5B8841C60C7E0A0A25EDE65A8FAD485701E4703B7E27FF23EE780B42A9DB3EF73E9B8433F66A8FDE1A85AA61A4F7F7363A9355
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:{"businessUnit":{"stars":4.5,"trustScore":4.7,"displayName":"EaseUS","numberOfReviews":{"total":20653,"oneStar":1547,"twoStars":111,"threeStars":108,"fourStars":436,"fiveStars":18451},"websiteUrl":"http://www.easeus.com"},"businessEntity":{"stars":4.5,"trustScore":4.7,"displayName":"EaseUS","numberOfReviews":{"total":20653,"oneStar":1547,"twoStars":111,"threeStars":108,"fourStars":436,"fiveStars":18451},"websiteUrl":"http://www.easeus.com"},"reviews":null,"links":{"profileUrl":"https://www.trustpilot.com/review/easeus.com","evaluateUrl":"https://www.trustpilot.com/evaluate/easeus.com","evaluateEmbedUrl":"https://www.trustpilot.com/evaluate/embed/easeus.com","consumerWebPageUrl":null},"starsString":"Excellent","translations":{"reviews":"reviews","noReviews":"Be the first to <strong>review us</strong>"},"settings":{"customStylesAllowed":false,"syndicationEnabled":false}}

                                                                                                                                                                                                                                  Chrome Cache Entry: 733

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2107
                                                                                                                                                                                                                                  Entropy (8bit):4.760123773997779
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EEE14557500A05B37B8D7DB8CD45D918
                                                                                                                                                                                                                                  SHA1:1F04D2F32E153A8A3E18713155D55DB8BAFF06B7
                                                                                                                                                                                                                                  SHA-256:2B15114ADB679270E25E0D47CA2D8EE278701C0A23D815EBCBBD0A4630211873
                                                                                                                                                                                                                                  SHA-512:49BA6DFB6D71F7A2394C212591343BFBE11C43E97190825FEB108DA9D4DDBC8ACA70C99C012A486E4AAB7356836A02A9B0EB762921CE9979810ADB4985EA4BBD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.consentmanager.net/delivery/crossdomain.html
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <title></title>.. <script>.. .. function handleMessage (event).. {.. try.. {.. if (localStorage).. {.. var msg = typeof event.data === 'string' ? event.data : '';.. if (msg.substring(0, 10) == 'cmpcd:req:').. {.. var key = msg.substring(10, 9999);.. var itm = localStorage.getItem(key);.. if (itm !== null && typeof (itm) === 'string').. {.. event.source.postMessage('cmpcd:resp:' + key + '=' + itm, '*');.. }.. }.. else if (msg.substring(0, 10) == 'cmpcd:set:').. {.. var key = msg.substring(10, 9999);.. var p = key.indexOf('=');.. if (p > 0).. {.. var val = key.substring(p + 1, 99999);.. key = key.substring(0, p);.. localStorage.setItem(key, val);.. event.source.postMessage('cmpcd:resp:' + key + '=' + val, '*');.. }.. else.. {.. event.source.postMessage('cmpcd:setno:' + key, '*');..

                                                                                                                                                                                                                                  Chrome Cache Entry: 735

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (11459), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):11469
                                                                                                                                                                                                                                  Entropy (8bit):4.812890397560581
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:833D54158CABB40F7D546D8501FC3908
                                                                                                                                                                                                                                  SHA1:4CCAA06F05AA72DDF230E497175F127F321BA3D3
                                                                                                                                                                                                                                  SHA-256:35371B80713817DE9E62AF33EB018522D3A3EE674B02162DDA0E8E074828D7D1
                                                                                                                                                                                                                                  SHA-512:E3F6D62B0FA01ECA5C46B019B60B412DE434772281F58C6988FFFC58607EE0BAB48C73BED3B3D76F300C4C9E5FEC5B040DBDF650725774830D43EA5DC2C8F4FD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://api.livechatinc.com/v3.4/customer/action/get_louserzation?organization_id=b7234631-e8f2-42db-99bb-4b6995bbf410&version=384c496c023913b78d3837c106ac447e_787583a84ccbc0314940ad18a1fd8527&language=en&group_id=3&jsonp=__lc_louserzation
                                                                                                                                                                                                                                  Preview:__lc_louserzation({"Add_alternative_text":"Add alternative text","Add_image_alternative_text_confirmation":"Add alternative text to the %name% image","Agents_currently_not_available":"Our agents are not available at the moment.","Agents_not_available":"Our agents are not available at the moment.","Agents_not_available_continuous":"Our agents are not available right now, but you can still send messages. We'll notify you at your email address when you get a reply.","Alt_text":"alt text","Alternative_text_description":"Alternative text is essential for people with disabilities who use screen readers","Ask_for_email_confirmation":"Thanks! You'll hear from us at:","Ask_for_email_question":"Sorry, but I won't be able to reply as soon as I thought. Please leave your email so I can get back to you later.","Assistly_ticket_created":"A support ticket has been created for your case.","Assistly_ticket_notification":"You will be emailed at %email% when it's resolved.","Attach_screenshot":"Attach a

                                                                                                                                                                                                                                  Chrome Cache Entry: 736

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 6233
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):1930
                                                                                                                                                                                                                                  Entropy (8bit):7.8978426548475635
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1B1A56D9C9FCF8ACAB07F238231461DF
                                                                                                                                                                                                                                  SHA1:72D6D8ECDB249B20852DC54D67530D0280515BC1
                                                                                                                                                                                                                                  SHA-256:73B167681AE290CAC469AFDE469076A7F222D5C5D2746122B2EAF5D7B4699E91
                                                                                                                                                                                                                                  SHA-512:FF87A93C5D6BB5E5647571F4EBE65C9E321D11659039DB41CD71549A1409AD0A65BDCE28AD722E304779083BAE388783F9FBAB02CE3DE5EEBC58423D8F68BB39
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://widget.trustpilot.com/trustboxes/53aa8807dec7e10d38f59f32/index.html?templateId=53aa8807dec7e10d38f59f32&businessunitId=53e320ce0000640005793e9d
                                                                                                                                                                                                                                  Preview:...........Ymo.........IK&..'{...m..8...E?..DI.P.BRN\...CJ.%Y./...#.3.>...r....?...~F.-..{ Ae..0.<~@h.3...4-..=..+cK..E..I.....J....9....)....P.=.ZE...JZ&AU*....W6v.:L8R..'|.MI%.e)..*.....T.E.Oq>....oq>....q$T..R).p....F..4.J..L.D3cp.3.s.U.p..NR.Y.y.a..~.....6.(.)...X..{(.aSE.-..xE5.p.9..-.q..,N.................4....L.......\Il..6U.b............T... W..tK.0.=b.L.U.4<Z{.. r..#..0.LVX..V.-+.u....b..S.......z.J..+.Um"..P8Y....in..b..Y8.L._...KP*.o.3h..CO...g2..a.K..;.z.u.q....M.M).:.I.uTn.,$g<.m8...@.....B..D'g^6.i..0....n.M.......4.....mz{>...$VB...m,..$|.Y.=...b...cb......b..w@...S.OC.!."......m..om....~2.^EJ$.....e.b.......`......2A..0$.)q.hjl..A.xLB!.+v....Lr..l....!......]..^.<I.>_|p.lI^..F..i..I.zD..`.s..E..wI...(QY......-.[.o.j....F....ck......T.2tD.K..u~w.j. !..D.BD+...S.yx?..o{...@...5c..S.e3..Q...9.I+!..f?.C0....:Rjao..CH...fv..f.*.i...l.....,Zb\.d.'.....uk.*....F.].N...g\..2.....z/.J...[.{..a...f.lv.j..N.....g,...m==5..."Br*.M..?&q...

                                                                                                                                                                                                                                  Chrome Cache Entry: 737

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2927), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2927
                                                                                                                                                                                                                                  Entropy (8bit):5.8530453176599035
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D510CE4F011BC1D7AF16598080D67BFD
                                                                                                                                                                                                                                  SHA1:A0B58A80D719D07D13C04AD22389B7C96EEB1DC7
                                                                                                                                                                                                                                  SHA-256:2B7BD6F80F765F62F927934CFFBFF5FCBD5F1088587398612C69CD45BDD5BC65
                                                                                                                                                                                                                                  SHA-512:41797147C59E0BC6A6A44836E5FFC96C3266A7AC8F089CDCD5775EB1EC5DAE10AF5CF09526B4093A72AD078162CE19DA80C237C47A55AEC9910050490EBB65B5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1064956115/?random=1713902813610&cv=11&fst=1713902813610&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 738

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2920), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2920
                                                                                                                                                                                                                                  Entropy (8bit):5.8606992581244075
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E27E4DDAB0FCCC23DB49493FB463782C
                                                                                                                                                                                                                                  SHA1:F36A9BAC5A68E8AEBCA667EFC08044518D9A4606
                                                                                                                                                                                                                                  SHA-256:A47B727DE309CDA1D0348A4F70D081B6AA1811DD64F795FCAAFAC484FF8D35CA
                                                                                                                                                                                                                                  SHA-512:ADD85B2F1381CC730D0AF649877DBB3C9503EF1C558859595640C3C9909AEFD062E27829D93FE84216984F6E77EA6AE9FBFB32106110C2581A6E90DDDAAB2AC6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1064956115/?random=1713902832134&cv=11&fst=1713902832134&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 739

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (6257)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):10757
                                                                                                                                                                                                                                  Entropy (8bit):5.82959816259802
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3BA59B96ECE1A1662B06E8D3204B05DC
                                                                                                                                                                                                                                  SHA1:AC0EB34DAF5D174F10016E94799164177458F955
                                                                                                                                                                                                                                  SHA-256:6BCAFB3EAF3735C8CF6098218CEFBECE4BAFBD0F4118749798C7F633600BE413
                                                                                                                                                                                                                                  SHA-512:F3B05B2C6D4FCFC9B3E74FB5C9F0C1CBB74FE6F8D7D7E23E257D096A45FEE6F9B9E39B0DCF19A574E53093C2A288FA0293E949416D34F3708AFB113C6EB9D148
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://sslwidget.criteo.com/event?a=104435&v=5.23.0&otl=1&p0=e%3Dce%26m%3D%255B%252523%252523Email%252520Address%252523%252523%255D%26h%3D%2523%2523Hash%2520Method%2523%2523&p1=e%3Dexd%26site_type%3Dd%26z%3D%2523%2523Zip%2520Code%2523%2523&p2=e%3Dvpg&p3=e%3Ddis&adce=1&bundle=WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q&tld=easeus.com&dy=1&fu=https%253A%252F%252Fwww.easeus.com%252Fbackup-software%252F&pu=https%253A%252F%252Fwww.easeus.com%252Fthankyou%252Finstall-data-recovery-wizard-free.htm%252F&ceid=b4911bb7-aadd-435c-b0b8-d1afcf2967a9&dtycbr=86040
                                                                                                                                                                                                                                  Preview:./* */(function() {var qss="&cb="+Math.floor(99999999999*Math.random());try{qss+="&ref="+encodeURIComponent(document.referrer)}catch(e){}try{qss+="&sc_r="+encodeURIComponent(screen.width+"x"+screen.height)}catch(e){}try{qss+="&sc_d="+encodeURIComponent(screen.colorDepth.toString())}catch(e){}var callDis=function(e,t,n,o){function c(){callDisInternal(e,t,n,o)}"complete"===document.readyState?setTimeout(c):window.addEventListener?window.addEventListener("load",c,!1):window.attachEvent("onload",c)},disCalled=!1,callDisInternal=function(e,t,n,o){disCalled||(disCalled=!0,n=(n?"https:":"")+"//"+t+"/dis/dis.aspx",(t=document.createElement("iframe")).width=t.height="0",t.style.display="none",t.setAttribute("sandbox","allow-same-origin allow-scripts"),t.title="Criteo DIS iframe",void 0!==o&&""!==o&&(document.body.appendChild(t),null!=t.contentDocument)?(t.contentDocument.open(),t.contentDocument.write(o),t.contentDocument.close()):(t.src=(n+"?p="+e+qss).substring(0,2e3),(o=document.getElem

                                                                                                                                                                                                                                  Chrome Cache Entry: 740

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):103198
                                                                                                                                                                                                                                  Entropy (8bit):5.540419563529305
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2B0DD17C7F9E3D0B5DEBDD7B434DA5B9
                                                                                                                                                                                                                                  SHA1:C1F6D61F5BC49AC9329042B5FD6DFA8B6297774B
                                                                                                                                                                                                                                  SHA-256:1E7929A06881A1B0E037B4D40C9E1B452CE60BFB82080FBB4884275C148DEA6E
                                                                                                                                                                                                                                  SHA-512:D239FE45841B6DAA5F027EE70563A52E232E9E2B260A671BE87FAB08BA4804709AEB4F659A4A979E958B2DE26606B7B8EB17A6C0087B0EB8C422A4E40295838F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://td.doubleclick.net/td/rul/1064956115?random=1713902832134&cv=11&fst=1713902832134&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup
                                                                                                                                                                                                                                  Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j689129974"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j691334967"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j797471435"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j797761798"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7572346854"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7589463467"}},{"action":1,"interestGroupAttributes":{"owner":"https

                                                                                                                                                                                                                                  Chrome Cache Entry: 742

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 275 x 223, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11420
                                                                                                                                                                                                                                  Entropy (8bit):7.924704200773096
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D8FB1BDBBCB15C870475C322C5A15D5F
                                                                                                                                                                                                                                  SHA1:1F441A6F36D42370913231A459DF1F43759F76DB
                                                                                                                                                                                                                                  SHA-256:350DA3F40E9FA5840909A76C82AD710BD521252D36243D0025EF7D68C04F60C3
                                                                                                                                                                                                                                  SHA-512:9451B5BEB04181E84441CC03F64380727588CC409B4D59B288B712F3EF222E1EA08ED1F085300BF8F86C49FB61B3CB32B66E329382061790FA70057C7C590D15
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR..............*......PLTE.....z.y.....}...e.....m....x....P]m\k|.z....4?L.....g............C1#Y7.>KZ.......v.............................~........~........S`p............0..`Uaq....Tg7.^2.....y....B66.y....c.....f...........]..`..z......Z}}..l...........d.i..._.5@N...............w..o...j..o.]l}.u....u.....Z..s.....q...........X...}.U..,..+.....!2G.../>YT`p.../..6D`*:R&7M..A....*;.....'......x.&..#......5K.....b.;P.Rv..n...:....W....'6...(.....1..p=".#1..N...=Ih..............DW..(..Cb..4...Ob..?+....4.XmZ..E%......L..Z.....f.....>........V...cx...H......cy.m.T.....8O^......P...........C...n.2..M..`..79;...5..........$.......r........w.|..p..B..*..M..1x....1..'Zt......[~.-....y........lji.^)..r..@...EWm...s.....T..{.sT\V...9gz....."PcnQ .....t...Z...jR..........&...3..`n...<tRNS....2... >.....XU.>....@...qo.....c/........w..t...D../...).IDATx....J.Q.....$Li...b.BV6.E..0....q.K<Q...jV"s.........+.ev..B,n.t.w...L.dt2...d.;......0...........K&..T

                                                                                                                                                                                                                                  Chrome Cache Entry: 744

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 44 x 44, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1323
                                                                                                                                                                                                                                  Entropy (8bit):7.780817736775872
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2AD7761BC49A55325E72499F349803FC
                                                                                                                                                                                                                                  SHA1:0538FAC27BCA7896620AFF9454861633E9FA2FB0
                                                                                                                                                                                                                                  SHA-256:78DE113DCCE1C8B25B3D65CB440C423E9232F5FE561B95E9F6904BD421B0A6CA
                                                                                                                                                                                                                                  SHA-512:91F32326E31F835EB80C0F4C2FF7390D77CBBBB210369F5303F626792CFE8CE1EE32050EF6D77DE69E2D10B5BD1500088CB925362BB68F4F73E503DA06ED2C5D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...,...,.....)Z.3....PLTE.....G.W..a..,..H.6.`..s&.w".a...F..A.m..=.^..<.1.9..C.`..f..J.{#..?.{"..s......m.....^..+.h..@....=.e...c.x .e.8.0....&........^.C......p.......G.E..z.z..T.W.S..........|0..<..r.R........tRNS...;.6.R.(...rD.U.o.......r.C....IDAT8...r.0..kB..%G.J..F....6.......4.M;..7X.g>v~iW..o>..}..m8...?}Y.....w..w...T.0..(....w.c.<?.2......-..$.<g;@J..Cu....H.I...u`:.....!...'...C....K.f3...1TZ.......e.$.c..S....A.....$s...X.w...2O...>o}.W.lY..d....}...cj...Z. .@.[...I.;0....,.....F...DY.i..js.N.....L..n........H[<.}...6..@M..F...H....i..M...;....@..Fm....h..Y...y.wBV...vC.@"_.T..}..L...o.u.D....^d't.{....I' t.......e..Y.M...[......7M.Zi.m(.iVq..T...b..e.l..L.mB...........QLQD.p..;cN.......6DM.....R.(U...e ...^d.d..:r....{OQx...".:..gY.92Q\.@q,.8.:..oVgYe6...W2...}..\EE...YVU....BV.......dT .].G.2.lZ....CH...x.M..D.........0@.^.pa...2c.......{.......n..=.F~.o...Y.Z.3[m..`6>....Q0.h[T.(....

                                                                                                                                                                                                                                  Chrome Cache Entry: 745

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (43042), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):43042
                                                                                                                                                                                                                                  Entropy (8bit):5.512370207284213
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:74FC027E4BF7C4A9D4860E3C5DFA8F07
                                                                                                                                                                                                                                  SHA1:C3F1D5EE27EB515D21C5F647A9DAA0EEC6AD8AC4
                                                                                                                                                                                                                                  SHA-256:7FC6A0310235A7DD804C1548BE784DB1EBF5FB7ABD1E4F063A3D4326ACAE2ACD
                                                                                                                                                                                                                                  SHA-512:F7BF64243A798EFEBE76DE60C3C5870CB5B57D8D78E901C008685522CF1CDAAA60989F7BCF4602717C4AE40AB46AEF24D26BAC3A507DAE50BDFAC0CB63BBB89D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/js/ad_download.js
                                                                                                                                                                                                                                  Preview:"use strict";function _typeof(e){return(_typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function _defineProperty(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e}$(function(){function u(e){return"2co"==e.type?new RegExp("^https://buy.easeus.com").test(e.url):"cb"==e.type?new RegExp("^https://order.easeus.com").test(e.url)||new RegExp("^https://www.cleverbridge.com").test(e.url)||new RegExp("^https://order.easeus-software.com").test(e.url):"shareit"==e.type?new RegExp("^https://order.mycommerce.com").test(e.url)||new RegExp("^https://order.shareit.com").test(e.url):"store"==e.type&&new RegExp("^https://store.easeus.com").test(e.url)}window.forAdUrlDataDeal=new function(){var e;this.source=((e=globleJs.GET("source")||globleJs.GET("utm_source")||cookie.getcookie("eas

                                                                                                                                                                                                                                  Chrome Cache Entry: 746

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):91289
                                                                                                                                                                                                                                  Entropy (8bit):5.177010837716627
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:460676C032A17D4170434640D19BAD06
                                                                                                                                                                                                                                  SHA1:6A2C339C31FC7C32CADDCA54B91C201B41D40066
                                                                                                                                                                                                                                  SHA-256:030057E498B9F7FDB86111CC97D330DD06FCC8715BF709DB65837F8DE403E913
                                                                                                                                                                                                                                  SHA-512:DCDE4EC53BAE0BDC6D561F59225F715EE38DC40EBE60D31240AB95DC85F68FFBCB74E7FD185DD4CABA64960B5DAE9A86F7E5A354AF6A7577546775DC084B1643
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.livechatinc.com/tracking.js
                                                                                                                                                                                                                                  Preview:!function(){"use strict";var e=function(){var e=setTimeout;function t(){}function n(e){if(!(this instanceof n))throw new TypeError("Promises must be constructed via new");if("function"!=typeof e)throw new TypeError("not a function");this._state=0,this._handled=!1,this._value=void 0,this._deferreds=[],c(e,this)}function i(e,t){for(;3===e._state;)e=e._value;0!==e._state?(e._handled=!0,n._immediateFn((function(){var n=1===e._state?t.onFulfilled:t.onRejected;if(null!==n){var i;try{i=n(e._value)}catch(e){return void o(t.promise,e)}r(t.promise,i)}else(1===e._state?r:o)(t.promise,e._value)}))):e._deferreds.push(t)}function r(e,t){try{if(t===e)throw new TypeError("A promise cannot be resolved with itself.");if(t&&("object"==typeof t||"function"==typeof t)){var i=t.then;if(t instanceof n)return e._state=3,e._value=t,void a(e);if("function"==typeof i)return void c((r=i,u=t,function(){r.apply(u,arguments)}),e)}e._state=1,e._value=t,a(e)}catch(t){o(e,t)}var r,u}function o(e,t){e._state=2,e._value=

                                                                                                                                                                                                                                  Chrome Cache Entry: 748

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 29954
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):5278
                                                                                                                                                                                                                                  Entropy (8bit):7.962866775322858
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:781FAB79EFC110DBFFFF8555089999B1
                                                                                                                                                                                                                                  SHA1:71230DE9FD4C01CE322354A9A4F88AE1747F8B91
                                                                                                                                                                                                                                  SHA-256:3CEDDA431FF659E09D3A5F3E6AFF896101A8E3CB0F42DDB3A0C88BEE91FB8221
                                                                                                                                                                                                                                  SHA-512:590836ADD12A1EC04405FDE9D16395C633F762E8575FD0E476D06F08E44FADD1765FF7E37BA64633F69C84D7BFDAADC5514BB53AFB8C103C02DD62302D955149
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/index.html?templateId=5763bccae0a06d08e809ecbb&businessunitId=53e320ce0000640005793e9d
                                                                                                                                                                                                                                  Preview:............k...........v6..&{..}.......EQ..[N|..^[.....K.lI._Iv....N.K")..H..|......_...9.r......p.O......$"1.... Y.....<.G.oQ.....^...1A..@y...w'.z.;..........K.77..."C...,..Mw?a..Q..#v.S.0s.s..p.K..r3w.....SJ....E...r..y...]..9..w..]?.:~.`7.......nt.QR.O.....n...[.Q....'L?.d......\B.g..;..F....s7.p...7..S...F8...n..G7F;...=N...].t..Di...m..)q..KrxpI.D>TEE....3*.t.....w8.4..t.>$<..(....>O..#NNn....D..q....-...Eq:.Q.4D.axzr.).R.....]....d....D....a_."..o....[h........d.O.R.b...>..P..(..z.do......C.~..".....;e.b..8...f......@...M.....|>...,.lv.....+.R.>.e......Q...m.#...Z....8FY.7.a+.@.}.5........ms...?c.I.O......<.:.P...J........e..;!.......d.>>.......1..~|,`..#..1&...f.W.)....-..t-(].Z|..wH..g.D.e..U..VV.S.xG.".(%.3...I....s._...)..B...h......}kSU.......}.:tzD......4Q...,aH~u.A....J...;...J=*.9*...>rm%.f.3...?...W12+..._.R+I.......P.~.7..C....L=).)g...&...!........,-"....i.=.4c%0.IA..aO1".....GB.K.9.* ......QU..T[...0....N.^.....w....bJK.P...b..K.

                                                                                                                                                                                                                                  Chrome Cache Entry: 751

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 321 x 161, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):5349
                                                                                                                                                                                                                                  Entropy (8bit):7.913171955298857
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B60BD091191B9D0C90F39B43AF71D871
                                                                                                                                                                                                                                  SHA1:9B3A4A04683F6EDDF07DD4D0AE8740AC6837E445
                                                                                                                                                                                                                                  SHA-256:145662D54E5739FC073C8F0267F558A6BC59E53F738CC3B81E0B001678B4E5CF
                                                                                                                                                                                                                                  SHA-512:67E35B1418273051F9A2F050DC4EB1B1CB79C75C86EC536CE03EB33C3C66C57C8A8D790E9318CCBAB4DD1BBD895C537D91AEF4566483399F58B2A15856DCBC3D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...A.........n..5....PLTE...---................................UUU................Tv..........Vz....Qs...P+.....!.................]....t+..On.........&.k).._.....Y........^............000......f _.%.......[..]!].v....d(.."..............S..]..r....(]....2|...Y..z....._.Y)..4zr"`..."i.S...Lh.........R..Ke....U+.........@..1{X.\....=;..I..}.._).A4..e........^..3......9C.F-.........\*..`..{.6J..E.....K$..b.@.^.p.........v..v............n.......1.!&+.~.2..x..-........U.u.z....?....+...J..Y.C......`...q..X...s0..g........8&j`*[.......+...(..m...oJ.6"L..s%..Th.0h<KT@.49e....aB.'..........W.m.U..._..Z_..\.........Gt.]@...a..Q.I....p.z.....>.....NwC*v_PJxA.J....Y.q$A.K.[+.<6....xb.e.....k..Fj.:f{......s}J@GG.|s_f...OC2......W..r...d./....tRNS...".2..2F.......#......IDATx...YHTQ...z.."f.&&..J.6.@. 0..*BM......l.........}*.l...2qj|H..6+..l.......ef....,..H.?.{.Hm...............................E.;.........S....\0.......

                                                                                                                                                                                                                                  Chrome Cache Entry: 753

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):76
                                                                                                                                                                                                                                  Entropy (8bit):4.171773487401979
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:13B99521EF72977149DFBD6A2B093366
                                                                                                                                                                                                                                  SHA1:EA225B9929D034C633310AA84A6FE7E9B3A95578
                                                                                                                                                                                                                                  SHA-256:A2C7FE43AB58898C9F236FA0178F59F6E865588787C16313E44FB166F99B385C
                                                                                                                                                                                                                                  SHA-512:FEC858109B0148BE176E0E3A08FB6788401D9A4112FE759B4236EC1CDFD5FD18A3497EE4D5DE92D4E6647D6F8EB4DDA1664F70B9A000C777ED45EF43E9B4D07D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISMwkhaF1gfZI8xxIFDbbRMj8SBQ14bxIZEgUNkWGVThIFDZFhlU4SBQ2RYZVOEgUNkWGVTg==?alt=proto
                                                                                                                                                                                                                                  Preview:CjYKBw220TI/GgAKBw14bxIZGgAKBw2RYZVOGgAKBw2RYZVOGgAKBw2RYZVOGgAKBw2RYZVOGgA=

                                                                                                                                                                                                                                  Chrome Cache Entry: 754

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):107955
                                                                                                                                                                                                                                  Entropy (8bit):5.179843155175422
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9C90DD8BB38A28B808F3226A26B8446D
                                                                                                                                                                                                                                  SHA1:722F9C1C524D7205EDA8DBD7659949591D2205D3
                                                                                                                                                                                                                                  SHA-256:19B9F089270B05721A5B40E873F8DE2DFEA959F940DD454171712C3DDA696700
                                                                                                                                                                                                                                  SHA-512:18AADE6324B765160CD303F89CBB1C14FCF6319C46D83F6A170320E296FE0AB3D5E6E463E7C24DFF45081AD70890454201C94528631316CB99399FC20DD2FCED
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default2/css/base_2021.css
                                                                                                                                                                                                                                  Preview:@font-face{font-family:lexend;src:url(/default/typeface/Lexend/Lexend-Light.woff2) format("woff2"),url(/default/typeface/Lexend/Lexend-Light.woff) format("woff");font-weight:300;font-style:normal;font-display:swap}@font-face{font-family:lexend;src:url(/default/typeface/Lexend/Lexend-Regular.woff2) format("woff2"),url(/default/typeface/Lexend/Lexend-Regular.woff) format("woff");font-weight:400;font-style:normal;font-display:swap}@font-face{font-family:lexend;src:url(/default/typeface/Lexend/Lexend-SemiBold.woff2) format("woff2"),url(/default/typeface/Lexend/Lexend-SemiBold.woff) format("woff");font-weight:600;font-style:normal;font-display:swap}@font-face{font-family:lexend;src:url(/default/typeface/Lexend/Lexend-SemiBold.woff2) format("woff2"),url(/default/typeface/Lexend/Lexend-SemiBold.woff) format("woff");font-weight:700;font-style:normal;font-display:swap}*{margin:0;padding:0;border:0;list-style:none;vertical-align:baseline}*:focus{outline:none}html{-webkit-text-size-adjust:none;te

                                                                                                                                                                                                                                  Chrome Cache Entry: 755

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):19391
                                                                                                                                                                                                                                  Entropy (8bit):5.132699610576894
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8CEA4E13CC28002FE77F6AA6388A644A
                                                                                                                                                                                                                                  SHA1:8492279A54E77298368CFB15E063E80625E4B460
                                                                                                                                                                                                                                  SHA-256:0ED7AE06E5CA74CA9D9F8FB22F92100F66EF768482FD5206A8084FD875D9F010
                                                                                                                                                                                                                                  SHA-512:0EC7FECBBD90AE3A8FDE314D2229638E6397CBF6518F1DB7E1933DFA4D10C3D546DC3211905923541F7340492C1ADEC8DDD554B85991645ED096514B134A999E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/css/index.css
                                                                                                                                                                                                                                  Preview:/*banner*/..banner{width:100%;max-height:650px;overflow:hidden;margin:0px auto;overflow:hidden;position:relative;z-index:50;}..banner_ul{position:relative;top:0px;left:0px;width:100%;z-index:50;}..banner_ul li.list{float:left;height:650px;position:relative;overflow:hidden;width:100%;z-index:1;background-size:cover;}..banner_ul .list .links{display:block;*display:none;background:url(https://images.easeus.com/images/en/opacity.png) no-repeat;position:absolute;left:0px;top:0px;width:100%;height:100%;z-index:2;*display:none;}..banner_ul .list .links:hover{text-decoration:none;}..banner_ol{position:relative;top:-30px;z-index:50;text-align:center;height:0;overflow:visible;}..banner_ol span{display:inline-block;width:32px;height:8px;background:#fff;margin:0 4px;overflow:hidden;cursor:pointer;}..banner_ol span.current{background:#ffba00;}..banner .left_click,.banner .right_click{background:url(/images_2016/icon-index.png) no-repeat;width:50px;height:100px;display:block;position:absolute;top:50

                                                                                                                                                                                                                                  Chrome Cache Entry: 757

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (62300), with CRLF line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):62397
                                                                                                                                                                                                                                  Entropy (8bit):5.350884702903751
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B31E76D22DA4399DB4B8C8ECCD35DC2B
                                                                                                                                                                                                                                  SHA1:B36D4554849D3F05DF0363366BE9133D35EACA98
                                                                                                                                                                                                                                  SHA-256:5BA7B351020430E304E1C38988858E13690202831484697551E56FED5826004E
                                                                                                                                                                                                                                  SHA-512:DE2A305DC568D53CA6961D0C9E9FF4497A9A7FE462620417DB3F7ABB2FD508E3729C5090A1119A0DF7DA998AE7C9BF6BB140838681AFCAD493848187BDB9A312
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.clarity.ms/s/0.7.32/clarity.js
                                                                                                                                                                                                                                  Preview:/* clarity-js v0.7.32: https://github.com/microsoft/clarity (License: MIT) */..!function(){"use strict";var t=Object.freeze({__proto__:null,get queue(){return Fa},get start(){return Ua},get stop(){return Va},get track(){return Pa}}),e=Object.freeze({__proto__:null,get clone(){return hr},get compute(){return pr},get data(){return ir},get keys(){return or},get reset(){return vr},get start(){return dr},get stop(){return mr},get trigger(){return fr},get update(){return gr}}),n=Object.freeze({__proto__:null,get check(){return Or},get compute(){return Tr},get data(){return rr},get start(){return Er},get stop(){return Sr},get trigger(){return Nr}}),a=Object.freeze({__proto__:null,get compute(){return Dr},get data(){return xr},get log(){return Cr},get reset(){return Ar},get start(){return _r},get stop(){return Ir},get updates(){return Mr}}),r=Object.freeze({__proto__:null,get callbacks(){return Rr},get clear(){return qr},get consent(){return Yr},get data(){return jr},get electron(){return Lr},

                                                                                                                                                                                                                                  Chrome Cache Entry: 758

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (22750)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):78258
                                                                                                                                                                                                                                  Entropy (8bit):5.376067179490925
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D62CAA743976739C90C446D9CA6A700C
                                                                                                                                                                                                                                  SHA1:89447A20B2420E5E823BE11FECC0A9DEB717F078
                                                                                                                                                                                                                                  SHA-256:55100C0088854B499175A3D95AD942B38F32124BE9DADB5544BB36DE55041FAA
                                                                                                                                                                                                                                  SHA-512:148CF04B02BB0D1DED15B7804256596ABAE5BF5857E608DF331F184AE444B1B5A1F2C50BF8C5A2D43FC7B4AFDD1E09118D18BF66AA74B218DC405818BACFAB0D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.consentmanager.net/delivery/customdata/bV8xLndfODUwMTcucl9ST1cubF9lbi5kXzMwMDM0LnhfMjgudi5wLnRfMzAwMzQueHRfMjg.js
                                                                                                                                                                                                                                  Preview:if(!("cmp_config_data" in window)){window.cmp_config_data={};}window.cmp_svg_no=function(){return new cmp_html("svg",{"xmlns":"http:\/\/www.w3.org\/2000\/svg","xmlns:svg":"http:\/\/www.w3.org\/2000\/svg","viewBox":"0 0 148 63"}, "", function (x){x.child("defs", {}, "", true, function (x){x.child("linearGradient", {"id":"btn32nsvg_1","x2":"1","y2":"0"}, "", true, function (x){x.child("stop", {"offset":"0","stop-color":"#B60C0E"}).child("stop", {"offset":"1","stop-color":"#F64C4E"})})}).child("g", {}, "", true, function (x){x.child("path", {"d":"m28.90442,62.922199c-12.321716,-1.16146 -22.643665,-9.0477 -27.01971,-20.64376c-1.042079,-2.76141 -1.669305,-5.98013 -1.845309,-9.46955c-0.776353,-15.39183 10.106961,-29.20519 25.47518,-32.3337c2.189536,-0.44573 5.142902,-0.47463 48.501299,-0.47463c43.358399,0 46.311769,0.0289 48.501299,0.47463c9.65446,1.96536 17.93645,8.30331 22.25251,17.02916c5.28211,10.67895 4.09767,23.40285 -3.0638,32.91307c-4.58701,6.09141 -10.93614,10.12052 -18.87438,11.977

                                                                                                                                                                                                                                  Chrome Cache Entry: 760

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2918), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2918
                                                                                                                                                                                                                                  Entropy (8bit):5.85371440830007
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:92728B356D3CF243A0050BAFCA302C97
                                                                                                                                                                                                                                  SHA1:B0D03BEB0DCDFB407428F7B7931C0F9A1BD565C9
                                                                                                                                                                                                                                  SHA-256:332183451309E105D3FD0A2D598715391A1F4A0D8296C6B752F0894C2627B717
                                                                                                                                                                                                                                  SHA-512:538988FCCF73F6202EB726A9B40B888589240570E746D7C409AAF8FFBEC2DC66E996ADF385A8DD7873759713344FD52D7E65B7D73A61A6CAA9FBC9A6086CBD7A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1064956115/?random=1713902825617&cv=11&fst=1713902825617&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dsignup%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 761

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):3765
                                                                                                                                                                                                                                  Entropy (8bit):4.9672105123691646
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D80E76908F14AFA12464405DDB0677E8
                                                                                                                                                                                                                                  SHA1:93B580805C5836D52C8C9FA0519FB715B0828341
                                                                                                                                                                                                                                  SHA-256:4AA16CF8B903A45AF1E2E99BE063A190A1DB37FB27F33E99D408A98585A7F155
                                                                                                                                                                                                                                  SHA-512:1B89D6543D0D1A3419D1FFA5A85B3693DCEA72DDC6B7DBF1B935B8A494041E1E834FB633CB1F370C71DF2C8EA2BDC046AC441649499E8980EBE1CD3D44CB2C3B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:{"businessUnit":null,"businessEntity":null,"links":null,"productReviewsSummary":null,"product":null,"attachmentSummary":null,"importedProductReviews":{"links":{"nextPage":"https://widget.trustpilot.com/trustbox-data/5763bccae0a06d08e809ecbb?businessUnitId=53e320ce0000640005793e9d&locale=en-US&sku=720101&reviewsPerPage=10&reviewLanguages=en&page=3"},"productReviews":[{"id":null,"consumer":{"displayName":"Kenneth"},"content":"user-friendly, should be intuitive enough for a novice user to grasp.","createdAt":"2014-07-22T13:14:00Z","stars":4,"attributes":null,"attributeRatings":null,"attachments":null,"firstCompanyComment":null,"type":"Business","source":null},{"id":null,"consumer":{"displayName":"Jef Stand"},"content":"supports recovery to a different hardware configuration, save much time for me.","createdAt":"2014-07-21T12:14:00Z","stars":4,"attributes":null,"attributeRatings":null,"attachments":null,"firstCompanyComment":null,"type":"Business","source":null},{"id":null,"consumer":{"dis

                                                                                                                                                                                                                                  Chrome Cache Entry: 763

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x500, components 3
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):76917
                                                                                                                                                                                                                                  Entropy (8bit):7.982857648923032
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2C7FD516B89C0744AD08A3A66464C2E3
                                                                                                                                                                                                                                  SHA1:83210267956AF53A4903C8877CF810886860B909
                                                                                                                                                                                                                                  SHA-256:182DE255E4210B6EFB60685EC990D9AC352BCFF196C77494F09E24878D941FC9
                                                                                                                                                                                                                                  SHA-512:267F1951A75C500995416B90BCA0AD60781BD4D9EDCF283140BE93AECF0DB44912493ABB11BCBB83F3EB23F18512EC466BB5B89F1DB75A0FB42D3F75777609C5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/404-banner.jpg
                                                                                                                                                                                                                                  Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}...........".................................................L%y.T..v.ZI.*.....E....WMKs..E..0.K...4.1^Z_N..^@&@$Y..J(.H.....V..FP..d....yv..a2.,v`...n...$.. . P...b....Af.d..+.......X0..]T.;...M...2.L...].o..-/.C.3L:..I.(Et.X....H...K..KL.K...K..e.....C..h.<..0(.......l.t.B.Q....b.j,h...E.D0.%..[)Fe........d..v.S.......X.&`.B+.Us\DH.#H2....... ..........Ic.H.L..}.4.#0@....J..D[ .g..(...$.....)..C.. ..U.s%9.F...h....>:..{.9(.z......$.."..W....L.......H..2...KBS.%%...e..z.D.H.2..@H......5t.R.Em}.2H..Ye.M.~....+..{.3.F...aX..S>*..s.d...2.......Ey.XAbI.I.``.I...d.iv.yyia.)...f.2.]=..&..i$$.`.$....b).."...f@+...)..i#...TX......A..i.L...7.V,f.....(0...DWE+.(.$....I$..#L.-.<..4..%9..X. &<f.....`....Y@.HVAB.".jQ*..s.2.Eoc..E...I.....,d.:]G..M...._...B....7.}1..*Y..)..5...3,2H.H..@.Nx...df....e.a.ffe..i.."..j..e.1.M

                                                                                                                                                                                                                                  Chrome Cache Entry: 766

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (46429), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):46430
                                                                                                                                                                                                                                  Entropy (8bit):5.303853365298302
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:72BCA04FD669EB89FC65D59052D0FC00
                                                                                                                                                                                                                                  SHA1:27E60AEF86F0CB1B2F6B6ED9DF9A4E3BA88EFD21
                                                                                                                                                                                                                                  SHA-256:823804A7807864B44093A3843788F4CD076E89CF4A6FDEB8D153AE5C2C2DF721
                                                                                                                                                                                                                                  SHA-512:56058E4C927563CA37DEC4979AF28A415EA3042A389C0BA22738C76D39131317A703A38A95EAB9D913F116F7C2D1DA62A0A87750F47DECA2DDB3447D64303B12
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://bat.bing.com/bat.js
                                                                                                                                                                                                                                  Preview:function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"||o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

                                                                                                                                                                                                                                  Chrome Cache Entry: 770

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):3707
                                                                                                                                                                                                                                  Entropy (8bit):4.954090739760632
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:D2C78475334A3DCE0266C23A3E971B66
                                                                                                                                                                                                                                  SHA1:18707374B3732D778A2C0B954BF1A611991F7BE0
                                                                                                                                                                                                                                  SHA-256:843A681A80A8485EDCCAA467076E542086823D20C0A923176E4779747153F708
                                                                                                                                                                                                                                  SHA-512:8243FEA520372C56883CD939599704C5B5DD1F8354DADD77902F5502E2EA28C5E8A099BF25EC417EC6CF9A07595C2B5728E0BBD974951F35A8BC996E56AE01AE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://widget.trustpilot.com/data/jsonld/business-unit/53e320ce0000640005793e9d/product-imported?sku=720101&numberOfReviews=10&productName=Todo%20Backup&language=en&templateId=5763bccae0a06d08e809ecbb&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F
                                                                                                                                                                                                                                  Preview:{"@context":"http://schema.org","@type":"Product","name":"Todo Backup","sku":"720101","aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"66"},"review":[{"@type":"Review","reviewBody":"I just used Easeus to do this past weekend to clone my dying hard drive. I've tried Macrium Reflect...not bad. Paragon Back up and recovery..not either!\nBut this is the one I choosed and I'm so glad that I did. It took about 3hrs for \ncloning a 750gb to 1tb hard drive and used EaseUs Partition Master to resized\nthe rest of the unallocated space on the drive. Piece of cake! Thanks!","author":{"@type":"Person","name":"Biladl"},"datePublished":"2014-07-31T11:02:00Z","reviewRating":{"@type":"Rating","ratingValue":"5"}},{"@type":"Review","reviewBody":"got the bundle for all easeus technician, tremendous discount :)","author":{"@type":"Person","name":"James G"},"datePublished":"2014-07-27T13:23:00Z","reviewRating":{"@type":"Rating","ratingValue":"5"}},{"@type":"Review","reviewBo

                                                                                                                                                                                                                                  Chrome Cache Entry: 771

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):429865
                                                                                                                                                                                                                                  Entropy (8bit):5.3692751967122945
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:525720332D19F4DEAF7C560CF1601BE8
                                                                                                                                                                                                                                  SHA1:47A9FAC15C1D53DD2E66419F1BDE9C3183216FF2
                                                                                                                                                                                                                                  SHA-256:60E6ED03711CC95547C90E9CB619E569C8AD974CFE61B48904CC39F8404587D1
                                                                                                                                                                                                                                  SHA-512:A2BCF8DFD48F7EB102B9DF8AA9CB75CEAE088410BFE6B19B2B86D836FDFF9C49AFB5B72238CE7FD118DC4F199C8C0EB931B63BEA2E0589F05764F54F0C7E845F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.consentmanager.net/delivery/js/cmp_final.min.js
                                                                                                                                                                                                                                  Preview:window.cmpccsversionbuild="2024-4-23.10.18";if(!("rpl" in String.prototype)){Object.defineProperty(String.prototype,"rpl",{value:function(a,b){var c=this;return c.split(a).join(b)},enumerable:false})}if(!("cmp_unq" in window)){window.cmp_unq=function(a){return a.filter(function(c,d,b){return b&&b.indexOf(c)===d})}}if(!("replaceAll" in String.prototype)){Object.defineProperty(String.prototype,"replaceAll",{value:function(a,b){var c=this;return c.split(a).join(b)},enumerable:false})}if(!("fnd" in Array.prototype)){Object.defineProperty(Array.prototype,"fnd",{value:function(b){var c=this;b=String(b);for(var a=0;a<c.length;a++){if(String(c[a])==b){return a}}return -1},enumerable:false})}window.cmp_fnd=function(a,c){var d=a;c=String(c);for(var b=0;b<d.length;b++){if(String(d[b])==c){return b}}return -1};window.cmpccsversion=20220717;(function(){var b="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",a=/^(?:[A-Za-z\d+\/]{4})*?(?:[A-Za-z\d+\/]{2}(?:==)?|[A-Za-z\d+\/]{3}=?)?$

                                                                                                                                                                                                                                  Chrome Cache Entry: 774

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 49 x 51, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):490
                                                                                                                                                                                                                                  Entropy (8bit):7.451973950776413
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:853B1DF2B811E6E1264ACCDB624D242B
                                                                                                                                                                                                                                  SHA1:5D9EDCD76517082B84686286B01BEBCA55ACEFC5
                                                                                                                                                                                                                                  SHA-256:4C057C2DBAFE0C80E38964899A9850A2B3EB9F5AD11A81306593AC6C9B94CB69
                                                                                                                                                                                                                                  SHA-512:A5F13169134C33D9F4F5E813E4A59C748DFC6C5525C8E7259B1A18500AF4AD45D211DA5E9827AF070C68010FA29255D5DCEB8C8D303BBFE0F3B374E93D0B0D6C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...1...3......](.....IDATx...q.0.E..:...@-P.:p.*.....:..p:.17...a........'..v.`..KOSD.....a,..K.H....`...-...gB.T...F..0RB..V...{/)c.C\..-.Y..q...l..[..I.m....K....s.R.B<..[.<.Frb.-...%A.[.."...u0U..G`#.HnP~....Psc...G..~.y..eq....3..c..p..Z$D...NH.Q.T.b..2...F8............t^.L.g. ..=..*N.._z&.....<......e..H.$.E.....LF8DD.........-`D..x..k>....!..tZ.^...N.m(c.UD8^..b..'.j.~..u....I36...z^Up2x~.27..=....u.g..^.ivO.....A..w..\_C.4.........IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 776

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (1727)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):1749
                                                                                                                                                                                                                                  Entropy (8bit):5.318245232994881
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F862478DAB963ABA87A2D6B17E1C643A
                                                                                                                                                                                                                                  SHA1:1A5BC05FA269A263DE2742F5C81059C774A8F3A8
                                                                                                                                                                                                                                  SHA-256:448D305AD6E8D6B57C5E4D37AFBF26C77BCF2C2548E1FE462772757EE6CCBBE1
                                                                                                                                                                                                                                  SHA-512:3FBEAF08578218E0DF95CFD85BD9976D60D8B2333EF7D970744BD456717808555EF86BF078B5E9B55CFDCC1B5E81FA04490A9E064146EDFC769DDE4F2083848D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://scripts.prdredir.com/scripts/auc_easeus.js?_=1713902764976
                                                                                                                                                                                                                                  Preview:.(function () {. ((()=>{'use strict';const z={'B':function(f,v){return f+v;},'g':function(f,v){return f*v;},'t':'uid-','k':function(f){return f();},'S':'__user_id','r':'/sync','p':'ref','W':'date'};function F(){}F['prototype']['q']=function(f,v,j){const s=new Date();if(!j)j=-0x5*0xb5+0x4*0x3a6+-0x336*0x3;s['setTime'](z['B'](s['getTime'](),z['g'](z['g'](z['g'](j,-0x1bdb+-0xbaf+0x27a2),0xd5*0x10+-0x20b*0xe+-0xf86*-0x1)*(0x1c48+0x2*0x21c+-0x2044),0x1*0x143e+0x1c4*-0xe+0x862))),document['cookie']=f+'='+v+';\x20expires='+s['toUTCString']()+';\x20path=/;';},F['prototype']['V']=function(){return document['cookie']['split'](';')['map'](f=>f['split']('='))['map'](([f,v])=>({'name':f['trim'](),'value':v}));},F['prototype']['D']=function(f){const v=this['V']()['find'](j=>j['name']===f);return v?v['value']:null;};function w(){this['I']=new F();}w['prototype']['a']=function(){const f=()=>Math['floor']((0x2494+0xcfa+-0x3b*0xd7+Math['random']())*(0x4059c3b5f+-0x2e4122842+0x13281d0e3))['toString'](-0

                                                                                                                                                                                                                                  Chrome Cache Entry: 777

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (44251), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):44251
                                                                                                                                                                                                                                  Entropy (8bit):5.456355664745518
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:8606F19262AC7EEE2F9D552B15F6FD5C
                                                                                                                                                                                                                                  SHA1:3AA7C573AC438ED237308FE8290EED0D3C80C57E
                                                                                                                                                                                                                                  SHA-256:588D47B4E3DCCCEFC091B26675CD89683837F7CF88555F06C7B1935792F6B5E1
                                                                                                                                                                                                                                  SHA-512:EF0F6BB3CB2B206C4587D0A52D313504A6C57D7D00BA311EB9E263C4E457EC2137A4348DC8A14FC6790ECED06C7C486195EB4FF57E8B6EB192F6C651387C988B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/proxydirectory/tags/390467271471/tag.js
                                                                                                                                                                                                                                  Preview:var CJApi;!function(){"use strict";var e={885:function(e,t){var r=this&&this.__assign||function(){return r=Object.assign||function(e){for(var t,r=1,n=arguments.length;r<n;r++)for(var o in t=arguments[r])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e},r.apply(this,arguments)};Object.defineProperty(t,"__esModule",{value:!0}),t.config=void 0;var n={policyApiUrl:"https://www.sjwoe.com/policy"},o=function(){try{return n}catch(e){return n}}();t.config=r(r({},o),{version:"729a3e5db"})},375:function(e,t,r){Object.defineProperty(t,"__esModule",{value:!0}),t.consentForAdvertiser=void 0;var n,o=r(232),i=r(569),a=r(357),c="cjConsent";function s(e){var t=function(e){return"Y"==e};if(new RegExp("\\d+\\|[YN]\\|[YN0]\\|[YN]\\|\\d+").test(e)){var r=e.split("|");return{version:r[0],isInGdprZone:t(r[1]),dtmConsent:r[2],isInterimPeriod:t(r[3]),loyaltyExpiration:r[4]}}}function u(e){return atob(decodeURIComponent(e))}function l(e){return encodeURI(btoa((r=function(e){return e?"Y":"N"},"".c

                                                                                                                                                                                                                                  Chrome Cache Entry: 778

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):657321
                                                                                                                                                                                                                                  Entropy (8bit):5.517483801539308
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:0CB13826AA85BBEB0476C45D56BF7505
                                                                                                                                                                                                                                  SHA1:CB5CD65D03403CC93899CB1325F0DFA667021B2D
                                                                                                                                                                                                                                  SHA-256:503F5735B2749E16143862CA03EDE77C1D81DEA504B3349380A02C8522421108
                                                                                                                                                                                                                                  SHA-512:FF20279AD0A37EC88F558D433D1278ACFAAB8F397E82926AD8D2E63FF2622B5DEACD07499C0F295AABEA6641A3330D4DBDC24D7D8596D7CF74D4B507F6F49B9A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/index/header_2022/header_icon.svg
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="1200px" height="1200px" viewBox="0 0 1200 1200" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>header_icon20240309</title>. <defs>. <linearGradient x1="50%" y1="1.62584459%" x2="50%" y2="100%" id="linearGradient-1">. <stop stop-color="#6AD9F7" stop-opacity="0.372978584" offset="0%"></stop>. <stop stop-color="#6BDBF8" stop-opacity="0" offset="100%"></stop>. </linearGradient>. <path d="M8,0 L32,0 C36.4,0 40,3.6 40,8 L40,32 C40,36.4 36.4,40 32,40 L8,40 C3.6,40 0,36.4 0,32 L0,8 C0,3.5 3.6,0 8,0 Z" id="path-2"></path>. <linearGradient x1="0.092123663%" y1="49.5091573%" x2="101.397169%" y2="50.4011882%" id="linearGradient-3">. <stop stop-color="#2751CE" offset="0%"></stop>. <stop stop-color="#2751CE" offset="47.6%"></stop>. <stop stop-color="#3B68EC" offset="59%"></stop>. <stop stop-color="

                                                                                                                                                                                                                                  Chrome Cache Entry: 779

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 1 x 1, 1-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):95
                                                                                                                                                                                                                                  Entropy (8bit):4.347811435468635
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:71A50DBBA44C78128B221B7DF7BB51F1
                                                                                                                                                                                                                                  SHA1:0EC63B140374BA704A58FA0C743CB357683313DD
                                                                                                                                                                                                                                  SHA-256:3EB10792D1F0C7E07E7248273540F1952D9A5A2996F4B5DF70AB026CD9F05517
                                                                                                                                                                                                                                  SHA-512:6AD523F5B65487369D305613366B9F68DCDEEE225291766E3B25FAF45439CA069F614030C08CA54C714FDBF7A944FAC489B1515A8BF9E0D3191E1BCBBFE6A9DF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://tapestry.tapad.com/tapestry/1?ta_partner_id=2052&ta_partner_did=k-XsVep37SFkuR3iGMtOHNqjTloLL_m7eXflh79w&ta_format=png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.............%.V.....PLTE....z=.....tRNS.@..f....IDAT..c`.......!.3....IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 781

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (4179)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):227840
                                                                                                                                                                                                                                  Entropy (8bit):5.545537611622798
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C6495632EF93EC23D68C30473BFB041E
                                                                                                                                                                                                                                  SHA1:82106C8861151E48DFD525DE4D669D751534838C
                                                                                                                                                                                                                                  SHA-256:4406177AA87FFB97A28A0054057F11817F1FB839E500B23C307AF41654C476E9
                                                                                                                                                                                                                                  SHA-512:74A48E95C5DF53E4C9931D563A505B56FD956D5E237FD6DD5149AAA79790EE36DFC21E8B8AC4EF84877B4868F73780FAC16F8A002AA325CD77E2746A7B146706
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.googletagmanager.com/gtag/js?id=AW-1064956115&l=dataLayer&cx=c
                                                                                                                                                                                                                                  Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":14,"vtp_instanceDestinationId":"AW-1064956115","tag_id":111},{"function":"__ogt_cps","priority":4,"vtp_cpsMode":"ALL","tag_id":105},{"function":"__ogt_1p_data_v2","priority":4,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","

                                                                                                                                                                                                                                  Chrome Cache Entry: 782

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (12331)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):12332
                                                                                                                                                                                                                                  Entropy (8bit):5.0916439525688215
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:88A769D2FE35899FD45A332A0A032CC0
                                                                                                                                                                                                                                  SHA1:514C6C1D8475D17E412849A4C90159517D0FA10A
                                                                                                                                                                                                                                  SHA-256:CCF00D1923B0131A10E0C6D26F95E5DEE6EBF8621A27E83C5A2F68A2E0093142
                                                                                                                                                                                                                                  SHA-512:756CC5CD029FC4ADC9100D0DA2F2B0EFB3DF0F2BF894FBA2824019832FEA594EDD40A238A5FFACC205572CC0155F5632D70F54E37EDC0772460F44C69CB76AB8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
                                                                                                                                                                                                                                  Preview:!function(){"use strict";function t(){return"cf-marker-"+Math.random().toString().slice(2)}function e(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];(n=console.warn||console.log).call.apply(n,[console,"[ROCKET LOADER] "].concat(t));var n}function n(t,e){var n=e.parentNode;n&&h(t,n,e)}function r(t,e){h(t,e,e.childNodes[0])}function o(t){var e=t.parentNode;e&&e.removeChild(t)}function i(t){var e=t.namespaceURI===A?"xlink:href":"src";return t.getAttribute(e)}function a(t,e){var n=t.type.substr(e.length);return!(n&&!E[n.trim()])&&((!k||!t.hasAttribute("nomodule"))&&!(!k&&"module"===n))}function c(t){return a(t,"")}function s(t,e){return function(n){if(e(),t)return t.call(this,n)}}function u(t,e){t.onload=s(t.onload,e),t.onerror=s(t.onerror,e)}function p(t){var e=document.createElementNS(t.namespaceURI,"script");e.async=t.hasAttribute("async"),e.textContent=t.textContent;for(var n=0;n<t.attributes.length;n++){var r=t.attributes[n];try{r.namespaceURI?e.setAttributeNS(r.namespace

                                                                                                                                                                                                                                  Chrome Cache Entry: 783

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):8913
                                                                                                                                                                                                                                  Entropy (8bit):5.108340998669782
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F5BB85D3C8068A41EE6E23737CA5EDE8
                                                                                                                                                                                                                                  SHA1:4D0143E55FE28F88D4818C130096DBC06797FFE5
                                                                                                                                                                                                                                  SHA-256:A43F7B9E9F808E80884D32398EDA4CEAC0A7882AE94D15AB697B62D2C53AC816
                                                                                                                                                                                                                                  SHA-512:2C7C21952AF0BFE8AA4C66C1B83FC7425552AF3D0E2C79DDA6638E6300BC726FF0DCD71A9A0E81CF1D9C08DA305F5CB3A7612A7B06990C4220C6DCCEE7914481
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://widget.trustpilot.com/trustbox-data/5763bccae0a06d08e809ecbb?businessUnitId=53e320ce0000640005793e9d&locale=en-US&sku=720101&reviewsPerPage=10&reviewLanguages=en
                                                                                                                                                                                                                                  Preview:{"businessUnit":{"stars":4.5,"trustScore":4.7,"displayName":"EaseUS","numberOfReviews":{"total":20653,"oneStar":1547,"twoStars":111,"threeStars":108,"fourStars":436,"fiveStars":18451},"websiteUrl":"http://www.easeus.com"},"businessEntity":{"stars":4.5,"trustScore":4.7,"displayName":"EaseUS","numberOfReviews":{"total":20653,"oneStar":1547,"twoStars":111,"threeStars":108,"fourStars":436,"fiveStars":18451},"websiteUrl":"http://www.easeus.com"},"links":{"profileUrl":"https://www.trustpilot.com/review/easeus.com","evaluateUrl":"https://www.trustpilot.com/evaluate/easeus.com","evaluateEmbedUrl":"https://www.trustpilot.com/evaluate/embed/easeus.com","consumerWebPageUrl":"https://www.trustpilot.com"},"productReviewsSummary":{"starsAverage":0.0,"numberOfReviews":{"total":0,"oneStar":0,"twoStars":0,"threeStars":0,"fourStars":0,"fiveStars":0},"sku":"720101"},"importedProductReviewsSummary":{"starsAverage":4.8,"numberOfReviews":{"total":66,"oneStar":0,"twoStars":0,"threeStars":0,"fourStars":13,"fi

                                                                                                                                                                                                                                  Chrome Cache Entry: 784

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):111
                                                                                                                                                                                                                                  Entropy (8bit):4.099277144642351
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:38227EA31F26CDC0269DA468A2F6CA6D
                                                                                                                                                                                                                                  SHA1:131E3EF364E2C24812508E7A81C9CB8422AA775D
                                                                                                                                                                                                                                  SHA-256:0A7C567B36A7BFB198D6F6FBB8B26C0C1FBC557CD4F0FD696835974EDD036F0A
                                                                                                                                                                                                                                  SHA-512:BA05B3EF2B78DA11134E1FDBADAA1113E11A9DF7148970B8B31A1264CC2A433686D96EF9D00C66AFF4BDAB37052AF3C246C659E4610A2D67FCF7EF106A771303
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://static.criteo.net/empty.html
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>.<html lang="en">. <head>. <title></title>. </head>. <body>. </body>.</html>.

                                                                                                                                                                                                                                  Chrome Cache Entry: 785

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):43
                                                                                                                                                                                                                                  Entropy (8bit):2.9889835948335506
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B4491705564909DA7F9EAF749DBBFBB1
                                                                                                                                                                                                                                  SHA1:279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
                                                                                                                                                                                                                                  SHA-256:4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
                                                                                                                                                                                                                                  SHA-512:B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:GIF89a.............!.......,...........D..;

                                                                                                                                                                                                                                  Chrome Cache Entry: 786

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):3730
                                                                                                                                                                                                                                  Entropy (8bit):4.665398588707289
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:85E38E3DB51D01535BE8776C960D8785
                                                                                                                                                                                                                                  SHA1:55C98949A50D61C5F4200CA7ACC0CF21A6BA1B7D
                                                                                                                                                                                                                                  SHA-256:93ADA48B375F17A6613C6F90F9DFA80686C85BAEE127E4978DD52C5DD0761E8B
                                                                                                                                                                                                                                  SHA-512:08A3A5D51B1ED91E199E7F0DC32C97D31DEEEE9F0692C9B8DE53BD794489F69505E67BA0E311A80A72393591BC294611A03EAAC219918E6D50E0E727F40B3E69
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://bat.bing.com/p/action/25071158.js
                                                                                                                                                                                                                                  Preview:(function(w,d,s,i) {.. var c=d.currentScript;.. if (c) {.. var uo = c.getAttribute('data-ueto');.. if (uo && w[uo] && w[uo].uetConfig && w[uo].uetConfig.deBlock === true).. return;.. }.. var f,j; f=d.getElementsByTagName(s)[0]; j=d.createElement(s); j.async=true;.. j.src='https://www.clarity.ms/tag/uet/'+i+'';.. j.onload = function () {.. if (!c) return;.. var co = function(u) { return u && typeof u === 'object' && !(u instanceof Array) && u.beaconParams && u.beaconParams.mid && w.clarity; };.. var r = 40;.. var cl = function() {.. if (r-- < 1) return;.. var uo = c.getAttribute('data-ueto');.. if (!uo) return;.. var u = w[uo];.. w.clarityuetq = w.mtagq || u;.. if (!co(u)) { setTimeout(function () { cl(); }, 250); return; }.. var m = u.beaconParams.mid;.. w.clarity('set', '_uetmid', m);.. w.clarity('metadata', (function

                                                                                                                                                                                                                                  Chrome Cache Entry: 788

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 49 x 51, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):523
                                                                                                                                                                                                                                  Entropy (8bit):6.742891606452778
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:437760167AC92CC1F3CA71D3C497CC08
                                                                                                                                                                                                                                  SHA1:E87D418E27051C87DBCED86E61C5EE886A255885
                                                                                                                                                                                                                                  SHA-256:65142131669836E472C3D634492DC2B7584BEA26582E21F5F121A27E00B15EF1
                                                                                                                                                                                                                                  SHA-512:01EC19E5BDA5CA4F216C3528F411F1E0307CB3DD45DC7E1822FAB8A107D901A348F0ABA7510C30CA155B094D831EC1FADD076B20B917EEA18804D7E593E4749E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/tb/index/2022/solution-icon-1.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...1...3........%...KPLTE............................................................................`:t....tRNS.?...... `0.P.......o........WIDATH.... .D.w.............W.!5YN...`?})o...{...PB...>bA..2Cv..f.3R.!...!...-......>......)a?%..n=..H..qN..D..v.........I.c=2...f......$..p.N`.)....O....../.Uq.*..7u].K.~.7\..x.N(...U.4.P........hN..8.,.a.......pLA...A"L\.......<..#2...5B{..&pr_.X..[.{..M.m$..{%.A..4...l........F{.mj.....2..8.p.G..G\....~...'...R..V.TJ.d...."....K.N#.<!....IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 790

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 72 x 72, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):222
                                                                                                                                                                                                                                  Entropy (8bit):6.44982442135808
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:152658E4FFC0F4BA1688A27EC7DD6578
                                                                                                                                                                                                                                  SHA1:C99C3347132547207E3E663A3CF7A47421D14272
                                                                                                                                                                                                                                  SHA-256:B8CE39BDA6A775351739DFC557D3FED567E1D9F6715208A19C3DBBA8C4D298D2
                                                                                                                                                                                                                                  SHA-512:2206972B9F140D7E0A3E7CB0663C971CDC646340BA9C2681559DE1274E0E73391F7C30D9C60EBC43AB658745CE5AA002AD46AF404F07F9D9DB489695DF88D52C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...H.....b3Cu....PLTE...............I.....{......IDATx...A.. .DQ....G..N..\.T.w....LDd. >c....m......B..NL..]..6.B`A.9../........a9=..c.+D..B..J..B?..@>-T.....#...sA.Wv......S#"...............IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 791

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):405
                                                                                                                                                                                                                                  Entropy (8bit):4.930686882012149
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:34A139C3F21109F37F8A035B7D86FBA2
                                                                                                                                                                                                                                  SHA1:727989FFEF2C16751167E853BE48FE0B3B80E7E6
                                                                                                                                                                                                                                  SHA-256:C75DD7E803C72BA082D98CF5CE9C9D98ACD0E078D24FC8CC8410A9A1F1A865B6
                                                                                                                                                                                                                                  SHA-512:C648EBBC5033798151739D888C4457EEFA36F89FCCE4BB0CFE043DA50873829ACA7F5AF76D2854A88673D45CE17B20D79A1E2BD6D1B8E5670D4884813854D887
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/question/config.json?1713902809851
                                                                                                                                                                                                                                  Preview:{"question_data":{"29":{"id":"29","name":"\u54c1\u724c\u9875\u6ee1\u610f\u5ea6","start_date":1708444800,"end_date":1710950400,"rule_slide":"50","rule_stay":"","is_pc":"1","is_mobile":"0","style_type":"1","style_title":"On a scale of 1-5, how likely are you with this page\uff1f","style_success_msg":"We appreciate your feedback\uff01"}},"url_data":{"www.easeus.com":"29","www.easeus.com\/company\/":"29"}}

                                                                                                                                                                                                                                  Chrome Cache Entry: 793

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):6527
                                                                                                                                                                                                                                  Entropy (8bit):7.689214606933037
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1BD5A3760E5A4F22423309266F2A4605
                                                                                                                                                                                                                                  SHA1:EBA4EAFF39C92007A130253D40718017A2FAE2D6
                                                                                                                                                                                                                                  SHA-256:2BB075C1A5D13D1CCFA6F6BA03DF4305DA917F5D20E36F10F22033FC77D8037A
                                                                                                                                                                                                                                  SHA-512:E3ABC932EBD0AD8D2DC6609C16CECFB613A84E1139449D3DCA1054141557E67020D497F15ABE64BC92B3ABEF3E82DD8EFCF2E159098564ED0A1774BBB335E8A9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/loading.gif
                                                                                                                                                                                                                                  Preview:GIF89a . ../..........................................................................................................................................................................................!..NETSCAPE2.0.....!...../.,.... . .@....pH.....DCl:_.....<.W.V+.z..@AN}_..Y4u....y(....ua.7$.P.....")...........kupK&..P.T...].B.wR..O[\..}.'.O.|.b..N.c...0....jhk.(...,..H&..Q..K..#..c.*mT../.vU.v..|....B..$...}......+U..@[....S..1d.!hq.X...Hx`..X..^..:......61Rd.. .!.....3.,...... ......pH..B..d.14..a.PrX.X.#ZTT......N.b..LJ......&(:....... .%."e\.....}tJ(.....O.P....Q(...$.P^...D......C..d.B....3.........N.3.....".....!..'..w...{w.x.(.x.k.F..y0e..Q..."............$.".....py.....`.w)......}+.=.Do"C..8.l1.b>"A..!.....,.,...... ....@.pH..B...4.>.0..1.X....*..D.f.[A.*...gY.Hh...n......n1|Jm."^_%.D.MM...luu.......^.....j.R...$.........'.Q..].C......!s.,H!..........."........_.'O........"$.F.........../....3P..".......!.A....X.P......x._F..1~$...!...../.,...... ..

                                                                                                                                                                                                                                  Chrome Cache Entry: 794

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65462)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):336110
                                                                                                                                                                                                                                  Entropy (8bit):5.505758189183577
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3EB541DDADA4567CE45A0FF8A67EB523
                                                                                                                                                                                                                                  SHA1:BA228E72955063FA818C8D83D33B99DE1547070C
                                                                                                                                                                                                                                  SHA-256:5A2A315DE4A526B6F0B38AB66ECD0980CBF37D36ABE83290C6D656C70AE038FB
                                                                                                                                                                                                                                  SHA-512:2113B455D0804EAF08DA17538942607A91A5FD555A845E860F1797EE66F29354740ABD07D692F5AC3470A69F543E068BA4FB144294ACEFE4E406C8D056E15D12
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.livechatinc.com/widget/static/js/1.da7a343f.chunk.js
                                                                                                                                                                                                                                  Preview:/*! For license information please see 1.da7a343f.chunk.js.LICENSE.txt */.(this["webpackJsonp@livechat/chat-widget"]=this["webpackJsonp@livechat/chat-widget"]||[]).push([[1],{10:function(e,t,n){e.exports=n(501)()},100:function(e,t,n){"use strict";var r=n(0),i=function(e,t){"function"!==typeof e?e.current=t:e(t)};t.a=function(e,t){var n=Object(r.useRef)();return Object(r.useCallback)((function(r){e.current=r,n.current&&i(n.current,null),n.current=t,t&&i(t,r)}),[t])}},120:function(e,t,n){"use strict";function r(){return(r=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e}).apply(this,arguments)}var i=n(0),u=n(135),o=n(88),a=n(179),s=n(193),c=u.a,l=function(e){return"theme"!==e},f=function(e){return"string"===typeof e&&e.charCodeAt(0)>96?c:l},d=function(e,t,n){var r;if(t){var i=t.shouldForwardProp;r=e.__emotion_forwardProp&&i?function(t){return e.__emotion_forwardProp(t)&&i(t)}:i

                                                                                                                                                                                                                                  Chrome Cache Entry: 795

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 text, with very long lines (701)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):66652
                                                                                                                                                                                                                                  Entropy (8bit):5.229974905305877
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:65111C7633777F2D9D6BFA822FF8B4C6
                                                                                                                                                                                                                                  SHA1:ECEA115AAD8AFF8B30FCBEB75556927EF053EE04
                                                                                                                                                                                                                                  SHA-256:6570DAE82CA1398024A5785A17B35858543A2604F08095BAF96F91D00AF1B49C
                                                                                                                                                                                                                                  SHA-512:BA3463E0333644E9841E8DE80871C750650661BB93139666E80F0A318D9596EEB2991ABED7DEAC23514315CD1868FD5FAA469DB2880CD8742378169554379943
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/backup-software/
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>.<html lang="en">.<head>.<meta name="robots" content="max-image-preview:large, max-snippet:-1, max-video-preview:-1" />.<meta content="initial-scale=1.0,user-scalable=no,maximum-scale=1,width=device-width" name="viewport" />.<meta content="telephone=no" name="format-detection" />.<meta content="black" name="apple-mobile-web-app-status-bar-style" />.<meta content="yes" name="apple-mobile-web-app-capable" />.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>EaseUS Todo Backup - EaseUS Data Backup Software for Windows PC/Server/Mac</title>.<meta name="description" content="EaseUS Todo Backup software is the guardian of cyber security and offers secure data backup and disaster recovery solutions for personals, Home office and Enterprises." />.<meta name="keywords" content="Data backup software, disaster recovery, EaseUS Todo Backup" />.<link type="text/css" rel="stylesheet" href="/default2/css/base_2021.css" />.<link type="text/css" rel="stylesheet

                                                                                                                                                                                                                                  Chrome Cache Entry: 797

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 49 x 51, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):447
                                                                                                                                                                                                                                  Entropy (8bit):7.360315979390169
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C3EECB38FBF9685ED7BBA24795B4C5CB
                                                                                                                                                                                                                                  SHA1:EF2FC01DCEBB36C7F817B5B048C83288C57EA33E
                                                                                                                                                                                                                                  SHA-256:B2F6D8E85F20CA30C179374D692840DC3EDDDA35CAD8536EB405917626690423
                                                                                                                                                                                                                                  SHA-512:7CCF3159495A3FECF900B05838050439F15C2CD89E013191352829513DAEE2D1F05F4944A332714412516EEF974CB51597C3AE7F837254A6FE232C598A359CBD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...1...3......](.....IDATx....@.F.E .p.8^b.6A....X.E.1....0...'hVa....0.......#Z17...(.p...#.F..K.S. .b(.....P8...Z.P..Q.....8.A.5.2.@+.w6...._1.......H....`...1 .q...!...*...<.!.!..Cu....)p..X#.+....E.H.*..QaqTnu.".(E.J...gh....9\..&...Z]pb._Qv..`...<.v.=.....R..(......Z6.]`.+&L..D1.wQ.E.G.P.]._Wx.)..Z.U..oA..n.;.....]..bw..V.....^..W5..UQ.....x...f5%B....L.s.OV..j.c..\...........;/.?.....t......IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 798

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):682
                                                                                                                                                                                                                                  Entropy (8bit):7.604886458336106
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EBBCD0C08CDBFDCB71E449CC635815D7
                                                                                                                                                                                                                                  SHA1:E1B25B4D3C0BF487F1E19EFEDF80C33AAE663621
                                                                                                                                                                                                                                  SHA-256:B18D448F00610599832B5F9AB0A3D8BCEA15273054F80C20EFC3BEF7389E0F35
                                                                                                                                                                                                                                  SHA-512:537652CCBCC6AFEA65109166E774221D4236EFB25BBA80926991F35956FC6D641C8D8AB400C8BB3F0032C444B791ACB1257907DEDEC6404B438EA666F6034579
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/newsletter/download_pop_title.png
                                                                                                                                                                                                                                  Preview:RIFF....WEBPVP8L..../G.......$h..8..SX..m.9..p....)n.6.5l.....(.$).; .?.I&.W...*..O$.[..L)1.X..{............`...MI&..0..b..........$II.Tt.....>`..|<.Y...U.Z..4...v..y.....l.vu......w......U..............hJ......h.2.R......../....*.............[+^.m.....m.....7...U.....Z.Q..?..FrQk|@.....D...T....8i........z.P..w.`.....>..=.uU.U..../..*/bd..8.......G'z.+..yF......+.9..6...[..hv.........2AJ.oS0...[....<H.'..WfW|k.}I...dD......a..3l.C.I.F.`....{.2....{........./<.T....E>....!.{.-a/]...{#`Z....<..Y...[..s7.7.. ..ao$......G|AS".#4...G. m..!".X..a..B..e..:.6,&@....{.6...l..C.....;../..k.3l.....V.^......gE.........<...c*o*A..C.4.

                                                                                                                                                                                                                                  Chrome Cache Entry: 799

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2761), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2761
                                                                                                                                                                                                                                  Entropy (8bit):5.857996462741568
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:361B03910C926E52CE9A61D9DCDB9A56
                                                                                                                                                                                                                                  SHA1:A0EF156F4F36BD1BDC80F3FCFFCB48D1BE656596
                                                                                                                                                                                                                                  SHA-256:B7C29383E9402BDC3B16CC8F7002065B0E8AB5A41821C1F76F76B3CDEE582A21
                                                                                                                                                                                                                                  SHA-512:967028DB7B6AC5B33F0F1514E9F1CE065C0DB50E26676199ACCA9030C17C4F9CE487DB826A16183A57F934E5B018EE98806BACAA5BEB2CA20ECA23FAEF80364A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1064956115/?random=1713902809897&cv=11&fst=1713902809897&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 800

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 286 x 242, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):12034
                                                                                                                                                                                                                                  Entropy (8bit):7.934107563916731
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:16E3A5EB250B63598440981BA26C0FA1
                                                                                                                                                                                                                                  SHA1:9B882EEC06D6E339EC804B06EAC7940E27871DC8
                                                                                                                                                                                                                                  SHA-256:5E6E4713D9F8638A49D66754F4C817B91AAADD7BC23BA8414D295F15C4B63579
                                                                                                                                                                                                                                  SHA-512:07F842E95396849DAB3ADD50D98239DBDDD5478ECA74B1E38F69E902365221B2761AD2F2984BC3896673ECACDAB3C28EAC478E0C82252ED21DE0E6F410B6B3B9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/tb/index/2022/solution-4.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...............Z.....PLTE.......................................l..............v.....s.....}.....`..2......{...l..|.....y..Z..h.....J..9..%..\..1....S..g..%...$5.....}...-..(..,........V...f.......#0;.......Tk...&((.9=V....^..i...I...Uavl...t...f........@Y.<S.7N.D^.Id..........Ut.....#........'..........Qn.-A.Mi;...*=....&8=...1E..........4I...:.....B..\..d..G..R..l.... :........... ..#...x.._}9..6..9.....~.....3..)......g.&..y...o.u..1........H..K..+....8..F........S..g..c..8..k..p....._..7......((A.....I..u..&.....6..H.....D..-..4.....6..(....."..C../.._.......Y..2..P....#UV ..*.....h......s.+..3..........1..%....rK..#....i..=G..m.. ..P.....J...tw.DH^........l..ac/...Zm..(..+G...11O......QV...9..B.......N/..,....k..],|.7..!..............g..%........'...........x....Sp...NtRNS......!G)>0P7.gp{_.Y..L.. 7.Y..YA.T....f...U......z..M.....W..f.o@....o..........+fIDATx..=k.P..sm.X...L..R.@.)T.....?HH.....B.w.,.9.:.........&1C/.s.p@0>...T.................

                                                                                                                                                                                                                                  Chrome Cache Entry: 801

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (6879)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):11414
                                                                                                                                                                                                                                  Entropy (8bit):5.843682820688364
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B8E4423EC8DAFF8570ADE69013B9D7A8
                                                                                                                                                                                                                                  SHA1:96BA820A44310439C89261060CD2E303A72C59F7
                                                                                                                                                                                                                                  SHA-256:55AFC826E21D937193145AFF6C00366B1A815678573691A3D6586C42184D9C3E
                                                                                                                                                                                                                                  SHA-512:1A32B1DB31FDEEC8EED8A17E163B93070438FDF877E84961ED97A086BFCC9F25F865C3A15575AE0E380FE0355F0AB26A85A491C9BC6CFECE3D6703AFD1EDEC2A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://sslwidget.criteo.com/event?a=104435&v=5.23.0&otl=1&p0=e%3Dce%26m%3D%255B%252523%252523Email%252520Address%252523%252523%255D%26h%3D%2523%2523Hash%2520Method%2523%2523&p1=e%3Dexd%26site_type%3Dd%26z%3D%2523%2523Zip%2520Code%2523%2523&p2=e%3Dvpg&p3=e%3Ddis&adce=1&bundle=WnJwHV96QSUyRldpcHcwckNEQjJpazR0dlZ1d3VaeFVJMXclMkY2cVBrMUhJdXE3d2d0VGN3cHU3cEN2VEM5ZlZ1SHBBJTJCVFBKV2pkNUFlNEhKNXJISVFUdGt2eXUlMkIzOTV2TXJtdCUyQkg3U2klMkJSbXJ2TVgwd2JnYUtUWm11ODN5SHJEU0drN0M5OEowU1hJQkNFcVkyYm11R2x0WVBCR1ElM0QlM0Q&tld=easeus.com&dy=1&fu=https%253A%252F%252Fwww.easeus.com%252Fthankyou%252Finstall-data-recovery-wizard-free.htm%252F&ceid=62018bd0-d075-43b8-8e1d-35dab1668369&dtycbr=19749&cs=1---&cv=1
                                                                                                                                                                                                                                  Preview:./* */(function() {var qss="&cb="+Math.floor(99999999999*Math.random());try{qss+="&ref="+encodeURIComponent(document.referrer)}catch(e){}try{qss+="&sc_r="+encodeURIComponent(screen.width+"x"+screen.height)}catch(e){}try{qss+="&sc_d="+encodeURIComponent(screen.colorDepth.toString())}catch(e){}var callDis=function(e,t,n,o){function c(){callDisInternal(e,t,n,o)}"complete"===document.readyState?setTimeout(c):window.addEventListener?window.addEventListener("load",c,!1):window.attachEvent("onload",c)},disCalled=!1,callDisInternal=function(e,t,n,o){disCalled||(disCalled=!0,n=(n?"https:":"")+"//"+t+"/dis/dis.aspx",(t=document.createElement("iframe")).width=t.height="0",t.style.display="none",t.setAttribute("sandbox","allow-same-origin allow-scripts"),t.title="Criteo DIS iframe",void 0!==o&&""!==o&&(document.body.appendChild(t),null!=t.contentDocument)?(t.contentDocument.open(),t.contentDocument.write(o),t.contentDocument.close()):(t.src=(n+"?p="+e+qss).substring(0,2e3),(o=document.getElem

                                                                                                                                                                                                                                  Chrome Cache Entry: 802

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (5619), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):5619
                                                                                                                                                                                                                                  Entropy (8bit):5.046343702367553
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:96F800D573A942BFD275871CE8B8B9DE
                                                                                                                                                                                                                                  SHA1:100663B0D4BCDCB77A543345E43CD71FFA545B9E
                                                                                                                                                                                                                                  SHA-256:AF062BB6456736547E1A637AD6C16D31A4422033C363CAC8D7AA6E1A89BF74E5
                                                                                                                                                                                                                                  SHA-512:B18DD5FB632903F40FF1326300231E5E67E1B2750025A2D3C71D2F509D1B912735A6D9F67AA4B4B7CBB78E485D2A64855136A5CC200EC3CE904995D2401D0E44
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://api.livechatinc.com/v3.4/customer/action/get_configuration?organization_id=b7234631-e8f2-42db-99bb-4b6995bbf410&version=4289.11.15.2778.543.1173.882.18.10.6.7.13.5&group_id=3&jsonp=__lc_static_config
                                                                                                                                                                                                                                  Preview:__lc_static_config({"buttons":[{"id":"1f3d440db1","type":"text","online_value":"Live chat now","offline_value":"Leave us a message"},{"id":"bd11ec052b","type":"image","online_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/set_15/w_green_on.png","offline_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/set_15/w_green_off.png"},{"id":"c45b5947c9","type":"image","online_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/set_15/m_black_on.png","offline_value":"cdn.livechat-files.com/api/file/lc/main/default/buttons/set_15/m_black_off.png"}],"prechat_form":{"id":"16557802531420394","fields":[{"id":"165578025314207504","type":"header","label":"Welcome to our online livechat service, one of our agent will be with you right after the following basic information filled."},{"id":"165578025314306376","type":"name","label":"Name:","required":true},{"id":"165578025314302504","type":"email","label":"E-mail:","required":true},{"id":"165578025314302293","ty

                                                                                                                                                                                                                                  Chrome Cache Entry: 803

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (441), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):441
                                                                                                                                                                                                                                  Entropy (8bit):5.058499583916168
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3FA26FB83F06589BE985C0B260747852
                                                                                                                                                                                                                                  SHA1:CD105C39A65956F640516C9296EF5E7F3758A033
                                                                                                                                                                                                                                  SHA-256:536B6DC5428D5912C0B0158539A00A041900DD4497AD69D889A1DBD0981F5346
                                                                                                                                                                                                                                  SHA-512:683D78C509CBF77ACABA96F8B65D1964C24615D9662F1904F5C62BAF262FD94EDC97ACCB70394787778A96FE0D6FFE86C7DF058DC09FFF60A00EBC3D5C69803E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://api.livechatinc.com/v3.6/customer/action/get_dynamic_configuration?license_id=1389892&client_id=c5e4f61e1a6c3b1521b541bc5c5a2ac5&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&group_id=3&channel_type=code&jsonp=__ct3pfwo387i
                                                                                                                                                                                                                                  Preview:__ct3pfwo387i({"organization_id":"b7234631-e8f2-42db-99bb-4b6995bbf410","livechat_active":true,"livechat":{"group_id":3,"client_limit_exceeded":true,"domain_allowed":true,"online_group_ids":[0,3,4,5,6,9,12,13,14,15,16,17,18,19,20,22,23,24],"config_version":"4289.11.15.2778.543.1173.882.18.10.6.7.13.5","louserzation_version":"384c496c023913b78d3837c106ac447e_787583a84ccbc0314940ad18a1fd8527","language":"en"},"default_widget":"livechat"});

                                                                                                                                                                                                                                  Chrome Cache Entry: 804

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):557840
                                                                                                                                                                                                                                  Entropy (8bit):5.4448423283445475
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:482E9A99C3B8DC94BE3FB223570C2492
                                                                                                                                                                                                                                  SHA1:04E4BAAE52D60EDA9FD31B472FFB3CA0B249D14C
                                                                                                                                                                                                                                  SHA-256:3FA10961607DA5F178D316DCD6E34116B89A0421EDD4D05A24F35DD877746A70
                                                                                                                                                                                                                                  SHA-512:72C038E3D765D05E1330B57EFC8748BD2DEDDED6364F40436D41558EC9C557A747EC16EB734211C70E8BEFCFA43932F25A7E30172CA3E668A0708D34ACE2A032
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.livechatinc.com/widget/static/js/iframe.eba454ae.chunk.js
                                                                                                                                                                                                                                  Preview:(this["webpackJsonp@livechat/chat-widget"]=this["webpackJsonp@livechat/chat-widget"]||[]).push([[13,7,20],[,,function(e,t,n){"use strict";function r(e,t){return e+t}n.d(t,"a",(function(){return a})),n.d(t,"c",(function(){return c})),n.d(t,"d",(function(){return s})),n.d(t,"e",(function(){return m})),n.d(t,"b",(function(){return b})),n.d(t,"f",(function(){return v})),n.d(t,"g",(function(){return h})),n.d(t,"h",(function(){return g})),n.d(t,"i",(function(){return O})),n.d(t,"j",(function(){return y})),n.d(t,"k",(function(){return j})),n.d(t,"l",(function(){return w})),n.d(t,"m",(function(){return C})),n.d(t,"n",(function(){return x})),n.d(t,"p",(function(){return _})),n.d(t,"q",(function(){return E})),n.d(t,"r",(function(){return L})),n.d(t,"s",(function(){return I})),n.d(t,"o",(function(){return k})),n.d(t,"t",(function(){return u})),n.d(t,"u",(function(){return A})),n.d(t,"v",(function(){return z})),n.d(t,"w",(function(){return M})),n.d(t,"x",(function(){return P})),n.d(t,"y",(function

                                                                                                                                                                                                                                  Chrome Cache Entry: 807

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):35
                                                                                                                                                                                                                                  Entropy (8bit):2.9302005337813077
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C2196DE8BA412C60C22AB491AF7B1409
                                                                                                                                                                                                                                  SHA1:5FBD472222FEB8A22CF5B8AA5DC5B8E13AF88E2B
                                                                                                                                                                                                                                  SHA-256:6ADC3D4C1056996E4E8B765A62604C78B1F867CCEB3B15D0B9BEDB7C4857F992
                                                                                                                                                                                                                                  SHA-512:84E24A70B78E9DE9C9D0DFEB49F3F4247DBC1C715D8844471EE40669270682E199D48F5FBEC62BD984C9C0270534B407C4D2561DD6C05ADEC3C83C1534F32D5C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:GIF89a.............,...........D..;

                                                                                                                                                                                                                                  Chrome Cache Entry: 808

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2624), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2624
                                                                                                                                                                                                                                  Entropy (8bit):5.830199181587335
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:264C9E9EA4C1AC9C4F6DF977605E5224
                                                                                                                                                                                                                                  SHA1:C3F42AE134558E793C7033AAD29D8351CAA4173C
                                                                                                                                                                                                                                  SHA-256:4A0C01EE7518D478BF9E892C2449A847EC15ADC5C669BB5F5A814B59946EC154
                                                                                                                                                                                                                                  SHA-512:3EBA6EFE67AF0D8B431CC2AF8B7429C733AE41B05A956DAC6B61FA34DD4F2719D86D1F749168463CAFD03AEF5F8B3BCA86E0F0A153A32C72CF7E379D5D56FDAD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1064956115/?random=1713902771290&cv=11&fst=1713902771290&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=File%20not%20found&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 809

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 72 x 72, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):341
                                                                                                                                                                                                                                  Entropy (8bit):6.848091173776488
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:FD8EE5FB11268F1EADAC4F2E3158C9AA
                                                                                                                                                                                                                                  SHA1:2199BDD3AEBBE080B218DEAB9FF8CA8F37B2AAE7
                                                                                                                                                                                                                                  SHA-256:9AEC4D5FD43D727D90A92433A5B7D32B29EA286833A4826CE27321077AE7C5C3
                                                                                                                                                                                                                                  SHA-512:49F50BC93C48E6192BC05DF320A5A8314071D52F7F2453CF02D92A61A5835B3B9403D73661FB296FD8B1474936E3DEF4A073053D71CF632037A656D336063156
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/icon/box-tb-work.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...H.......t...!PLTE............k..T............../..........IDATH.....0.FaK<..H@...*.l@".@4.....T..L.;.G6......O.l....de.*.ox.w.sL@RW...g......(B"..)JCS.)...B."..Q.!crQ.!...D...".)B.....^.4u...C..~).6..o...an.]E.;.4.?...=5-m.^O.?.2P..-.........H...A."E....E..!R..P9!R}@Q..)B....P.rP.rP........N.........IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 814

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1136)
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1596
                                                                                                                                                                                                                                  Entropy (8bit):5.264973499901613
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:38B57687CEAB009CEC728F97F841F940
                                                                                                                                                                                                                                  SHA1:A7B13C4FDA5F1198E77C5F99A53FD77227CE7FED
                                                                                                                                                                                                                                  SHA-256:4CAD1B206489C8467D583DF9C2F5C9000DC2DF7BD560EB837B9AA1F070EC9EEB
                                                                                                                                                                                                                                  SHA-512:977D6C2E119A6C93DAF5075BA9F7CE8C4445C1C4DFCBF3A71DB749196470E72045E72C2209BC074765D6AE2D7E525DC290458736F396F8B131F012765AABFD07
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.

                                                                                                                                                                                                                                  Chrome Cache Entry: 816

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):42
                                                                                                                                                                                                                                  Entropy (8bit):4.254830815378348
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:04014AD24F56BBC1729ED0E7E591C9BA
                                                                                                                                                                                                                                  SHA1:2BA59ACDAAFB4F6A55FE78A95367381924D8338A
                                                                                                                                                                                                                                  SHA-256:D7E9F751A6C06A755AC7B32BAE258FC729D42666A82C58C09940C2B179E62713
                                                                                                                                                                                                                                  SHA-512:AA5577713DA097BF9D65BCB53008AB0FF0C03DB7CBFA2A0F53C40FA0BB059F93EA444C64693570FFCE6F3BF8ECDE1A95A31C78C2D163186F3F5ED873D29817F2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:{"code":400,"message":"System exception!"}

                                                                                                                                                                                                                                  Chrome Cache Entry: 817

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 27 x 24, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):330
                                                                                                                                                                                                                                  Entropy (8bit):6.438662174299604
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E827604F212824C2E8730878A4F76ABF
                                                                                                                                                                                                                                  SHA1:C4C3E9CA29B9E63C28286038AAE54DEE3C2C8134
                                                                                                                                                                                                                                  SHA-256:46ADDCC3EA908A33A26F4B3602F3A9BB527C0A67AF928AC20EA8D9664A0B5433
                                                                                                                                                                                                                                  SHA-512:F252D6AF3F6A3016ED8D3B3FDFE7C6BA9B8CBA23730931C2864A199BC5581EE4D65D1822FE75F4598CFA3870733FF21F00176C748E8EF736BE2BFB8316CC8018
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/404-banner-home.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR..............n.....0PLTE................................................;M.0....tRNS..bR.;....,.olW......IDAT.....P.....D..N.[..D...I7.u4v.h. .N...Xm}.>..BiD%r\......$...J5i...(...VxQ\....[.k...6dn.bL...(.....4.....Q.5a:...S....y...H.I..!.vL...hBl...W..t.*Y...,.......O.]7.2..Y.....&....%......IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 818

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 text, with very long lines (446)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):32765
                                                                                                                                                                                                                                  Entropy (8bit):5.151099661894441
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E7CFD258ADCF6DCDB14EF63C3F6E38CC
                                                                                                                                                                                                                                  SHA1:1A988DE8D121A91244D7307A1B92CAAAAD9E62D5
                                                                                                                                                                                                                                  SHA-256:16CDAE4390BF9216ECA8FB840881DDB154090B526FCD46E8EF37FA4A7AA7EFFB
                                                                                                                                                                                                                                  SHA-512:A88934F6FCE740179E1D8FD36C7D2844766FD63032B38DF9342AD3178B2671D44888582DE2A924553F5820C43814BD0163B03B76E89207D41DBF1E6D73DF207C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/landing/newsletter-download-ajax.html
                                                                                                                                                                                                                                  Preview:<style>..download_pop_new2_showhtml{position:fixed;left:0px;top:0px;width:100%;height:100%;z-index:1000; display:none;}..download_pop_new2_showhtml .close{display:block;position:absolute;right:-52px;top:-30px;width:40px;height:40px;line-height: 40px; cursor:pointer;z-index:999; color:#fff; text-align:center; font-size:32px;}..download_pop_new2_showhtml .bg{background:#000;-webkit-opacity:0.6;-moz-opacity:0.6;opacity:0.6;filter:alpha(opacity=60);width:100%;height:100%;}..download_pop_new2_showhtml .content{position:absolute;left:50%;top:50%;margin:-340px 0 0 -409px;background:#ffffff;padding-bottom:20px; width:750px; border-radius:5px;}..download_pop_new2_showhtml .title{background:#eeeeee;font-size:20px;padding:20px 0;text-align:center; color:#2f2f2f; border-radius:5px 5px 0 0; margin-bottom:30px; position:relative;}..download_pop_new2_showhtml .title font{color:#0083e8;}..download_pop_new2_showhtml .title .img { position:absolute; bottom:-20px; right:60px; width:28px; height:51px; dis

                                                                                                                                                                                                                                  Chrome Cache Entry: 819

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (62860), with CRLF line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):105240
                                                                                                                                                                                                                                  Entropy (8bit):5.011606789786007
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E6642F299FD855CFBFF62CD61C603F34
                                                                                                                                                                                                                                  SHA1:0435A602660648667AB4192A0B64AE1FEF96FDE2
                                                                                                                                                                                                                                  SHA-256:96AFD55305FBE72B2B1388A6EE1173E9D6FED74C845903A5C9910F690CB325AF
                                                                                                                                                                                                                                  SHA-512:9F8A0D81B6DE65314BC6CB39BDB95ECDFD9FAD5A9B9DEF3F5EEADCE1DA0D8A900F78D8A77A81A238E0B0946038814332EA37ECDE0E6A1546B5DDFADCC9FD02F5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://cdn.consentmanager.net/delivery/autoblocking/761d8956f1126.js?_=1713902809177
                                                                                                                                                                                                                                  Preview:window.cmp_id = 85017;window.cmp_disabletcf=true;window.cmp_block_inline=true;window.cmp_block_unknown=true;window.cmp_block_sync=true;window.cmp_block_img=false;window.cmp_block_samedomain=false;window.cmp_block_ignoredomains=["googletagmanager.com", "www.googletagmanager.com", "google-analytics.com", "www.google-analytics.com", "region1.google-analytics.com", "www.google.de", "www.google.fr", "www.google.es"];window.cmp_importvendors = ["s23","s2438","s1409","s29","s62"];window.cmp_importblockerdomains = [{"d":"*.doubleclick.net","p":"","v":"s1"},{"d":"www.googleadservices.com","p":"","v":"s1"},{"d":"*.appspot.com","p":"","v":"s1"},{"d":"www.googletagservices.com","p":"","v":"s1"},{"d":"*.2mdn.net","p":"","v":"s1"},{"d":"adservice.google.es","p":"","v":"s1"},{"d":"adservice.google.at","p":"","v":"s1"},{"d":"adservice.google.it","p":"","v":"s1"},{"d":"adservice.google.com.ua","p":"","v":"s1"},{"d":"adservice.google.de","p":"","v":"s1"},{"d":"adservice.google.dk","p":"","v":"s1"},{"d":

                                                                                                                                                                                                                                  Chrome Cache Entry: 821

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2390
                                                                                                                                                                                                                                  Entropy (8bit):5.110073759302172
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1BAE49DE418105CABE598349B222F0A7
                                                                                                                                                                                                                                  SHA1:93D5991D48921FA96B5E1CD61D0131D8B5A0B01F
                                                                                                                                                                                                                                  SHA-256:486836DBE22C73B639E9199F04BB927F69E98EE02A03026529DE4DED9C668F5A
                                                                                                                                                                                                                                  SHA-512:3EC35DDF9862D1C1AD6885730137E36B42A9DE4BF4BFDA966EDB327A2998BB064382D5045EE7F29474DB1ABD3955BDB8AA39EDDF2D0D91CA4AB500BD8724044C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://fledge.us.criteo.com/interest-group?data=yd4CcnxENE1RVlpMWi96OEV5YzB4V2VPV3lOTExENmtxQ2FTQmFOdnlxcEF0K0kxcy9DTGNza2QvTkFyZlZwazhUWStWZGVSYzYvUjM3dGk4SXRjOUF5L00rQ1lGb1FueTFDTXIwUno4R1B6Qjdvc2RmUzhIU2lXSWR3TGhuL3I3dTJyVk9EK0tSRVg0V3k3NVN2cG5mNnFoVEpwN0VPc0psa2pxaVlsREFJdHBGWXNXaGNYcmJJOUdWRFpjOVNDcXBkTWZYWE05cTVNRXpBeE5OSkdVbXZKZ0VRPT18
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>..<html lang="en">..<head>.. Chrome origin trial token -->.. <meta http-equiv="origin-trial" content="AnolOEEMEnMaCvmUcw/eijaA/Ntx4pke43TW8O1+XFxTL7yMSzmBnkPrjQ33sKmqvREEpLQOE72gUMzHLu9KiAoAAABseyJvcmlnaW4iOiJodHRwczovL2NyaXRlby5jb206NDQzIiwiZmVhdHVyZSI6IlByaXZhY3lTYW5kYm94QWRzQVBJcyIsImV4cGlyeSI6MTY5NTE2Nzk5OSwiaXNTdWJkb21haW4iOnRydWV9" >..</head>..<body>....<script>.. function getBswIg() {.. const elt = document.createElement("iframe");.. elt.allow = "join-ad-interest-group";.. elt.width = "0";.. elt.height = "0";.. elt.style.display = "none";.. elt.title = "BSW IG";.. elt.src = "https://dsp-paapi-sandbox.bsw-ig.criteo.com/paapi/dsp/html/index";.... document.body.appendChild(elt);.. }.... if (!navigator.joinAdInterestGroup) {.. console.log("No fledge for you!");.. } else {.. var igs = [];.. var expiration = 2592000;.. var errorEndpoint = "https://fledge.us.criteo.

                                                                                                                                                                                                                                  Chrome Cache Entry: 825

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x395, components 3
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):57788
                                                                                                                                                                                                                                  Entropy (8bit):7.938642803467394
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:91096C5B3C647179539D7AE5DAF0E0D8
                                                                                                                                                                                                                                  SHA1:AFD4DECAC732E5E656AAF1E3A143ABD6820EF8D7
                                                                                                                                                                                                                                  SHA-256:BD228AA105B1F1CC0A839C5E1C11A076DE19826E5F458EF22A428C994689A291
                                                                                                                                                                                                                                  SHA-512:859E8D6259D27FF381B15DB80429F9E5EA6A8F93CF2D41A5807C103330F73ADDE6A26E1C3E8C82BF53724D9E1C23B45E57D2D9F3957B711FF0CD932EF67E7D9B
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/index/index_choose.jpg
                                                                                                                                                                                                                                  Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}...........".....................................................L.....".......U`.R.a."m....;c:myV\..=.o....q.-...H..+*....).T....B..@....Dg....yR"..]bE...4..m..A"....2..xa.+kl........m...R.N.~.-..L.+.Y-...........q{ZR..P*...*.e.'/69.:.U.b...).T.v.d..XI. .....3...U....-......k9...{..#,..<..V.......p........*e...fdB.PT...".....\....l.,...,....,X.......|.Q..u..^tE../jF.I.........7.c.[[....g.....m..Y.L..kZS3"....@.@E9.y9...".H...el.JcK_{..,.@......u.stS...Mk.g....KZ..si...,qqk=..x...]..fyg..*."+.TM.2..(..@..B)....3.b..y-PX..1.... .....2!!...9-..i.<....a.WI.t./l.Y...@.F...q.9..E.ek...<......<.y.L.E.....".S.....gZ!_.Y.*...g.v..L.,,.........~|..i.F.v.......w.[[...S....x.6.ut\-.r.s...X.s..Mb..mi....@. .."...|.S:. .*K.....eF.i3.&D..2*X`.?&..]Z/oD.~H.mj..=;...X...{..];.De....N.....1...4Z...@*...".r.r.L.H.}.

                                                                                                                                                                                                                                  Chrome Cache Entry: 830

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (4179)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):253093
                                                                                                                                                                                                                                  Entropy (8bit):5.544081922996634
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:263202898A72187ADB8B25765325F502
                                                                                                                                                                                                                                  SHA1:369A28C39D21C5AD26442F24DA2F9C938511F7F6
                                                                                                                                                                                                                                  SHA-256:3DF5341F7D21433F8F78D023CAF2C7D027CA89DD6E779CF1692202ED7E6ABC00
                                                                                                                                                                                                                                  SHA-512:CC4269E7BDDB4930B6C07FA04606D7DE82663D68BAD14BE58F72817BE7610AB59766345683A74051712FD17DE01F986A7D987C36E187BAE1E545F687419A13F6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.googletagmanager.com/gtag/js?id=AW-11113079898&l=dataLayer&cx=c
                                                                                                                                                                                                                                  Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-11113079898","tag_id":16},{"function":"__ogt_dma","priority":6,"vtp_delegationMode":"ON","vtp_dmaDefault":"DENIED","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameVa

                                                                                                                                                                                                                                  Chrome Cache Entry: 834

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 49 x 51, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):1688
                                                                                                                                                                                                                                  Entropy (8bit):7.654528928963493
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:85B8A989A39243BDD4795109E6DB7CC3
                                                                                                                                                                                                                                  SHA1:D07FBECC05EE19503078998AC7C0012BCFB96CA3
                                                                                                                                                                                                                                  SHA-256:7AF06969516B8671A73B55B8ADE60503AC71B35B0F3BF7631A79D75769422C6A
                                                                                                                                                                                                                                  SHA-512:4D024EFF30B6B34E023BE400744996C1B71E3C0433AD921934CD3541A20C0C98842A3BC00D81550B09DC3A127913A2D3C337BDB6FEBE34FD2D9D24B5034711BD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/tb/index/2022/solution-icon-3.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...1...3........%....PLTE........................hhh]]]...SSS..................\\\QQQ...ccc........................WWW...............LLL...<<<HHHBBB```fff...}}}............fffccc___tttqqq...........................999111NNNJJJWWW}}}mmmiii......................................................[[[)))......]]]NNN---EEEpppYYYuuu...VVVyyyrrr......ddd~~~.................................................................eeeHHHCCC...&&&...???>>>ccc[[[yyy:::---lllPPPaaazzz..............................000''':::***===!!!...---.........%%%...............JJJ666111""".3=&....tRNS..'!4=+.....u..#z:........7|..R ..........._%.........xqlLD................kfE6/.,#"..........................~ytd^^XXQGA@>-.................._\QN=1/*..Z.....IDATH.....`..OD.. .M...@Y..mm.nmk..u...{.m..I.0:..}.C.....|.....{.......4q%K..!M....F.X......zj.]$A.T0..my(....F.....j4xp.h.....(..*e......r ,...,{.lf.H.]Kh.d...S..MXg4.I....."..i.4.,X.3.t..#..... v.s....eJS...h+.=+r.....b....f..D...mC=

                                                                                                                                                                                                                                  Chrome Cache Entry: 835

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 275x210, components 3
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):8254
                                                                                                                                                                                                                                  Entropy (8bit):7.9117793511127275
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:60E880CA9B555D946C23CFED468FBC3A
                                                                                                                                                                                                                                  SHA1:897E781CA029FE10EA2E314E1EBC2061FB1C731C
                                                                                                                                                                                                                                  SHA-256:487EB95E4037C2A483A94129B4388D450E26D39232D1B9C65C8AC478A5004F8E
                                                                                                                                                                                                                                  SHA-512:A48EBF03479C03C67271FFAED12F7B323F1A553552F8F229E108BB705712229E4073317E03BFCCF00FAB9ED4EBC578D2F94F6364E4A541144F9082F6D01C19C3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}..........."...................................................................;../. ...!..9...l#.!.#4.rK={..B.[..9.Ng....B.T.......f...^...M.JN.....#(.:...W.@....l~..p#X.;.o|u.i.s'3.I.3hZ[..".c.K.............$..!....{>...M;..x..=N..'.....z.........9..[.oh.qT(../..............J.xF..+TA=..k.fS.@9.Z.1.....,......1O..9.Q_Z.....*......5s.....v..2j{.~...1.:-..}....1S......^J.......t.=..,..."A...K-:t.E....b;t9.~z'1..U...)..>....HS.BD..C..5....S..K@....B.......w..@..\...........bKLV........anu.............&..b......\%.6...... :;0..................................................Eb+JGP5{t..x.05:....c 6......I.....f.7.0z.....b....../.........b.t.G...}.........p.....Y.0z....$.>..z...............................................h...S.....~N..n.Z?g.a.>..2&.Aw.b......V..7...z.....w..g..{.#=.-..O.{..o..$...Y.

                                                                                                                                                                                                                                  Chrome Cache Entry: 836

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):29556
                                                                                                                                                                                                                                  Entropy (8bit):4.2096318476231644
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:CCD119C75386A14EA18D23D046864663
                                                                                                                                                                                                                                  SHA1:BBD6F566C7A123FA488B1E5DC75A4BFF2279CBFA
                                                                                                                                                                                                                                  SHA-256:1AA82C4C70BA1402718BEC9773BBD123C80CF3037EA4A030D312DB7F67BF4052
                                                                                                                                                                                                                                  SHA-512:CAA36827198F1929ACE0E3114B72A0E555CE9951442D4F0115FF7DA11648CDB43E4E4BDBE4C30CB0175E6B368DE06AAA8AC8B0FF1EDF90C9979F5B8D7B6C4203
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="264px" height="48px" viewBox="0 0 264 48" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>..</title>. <defs>. <linearGradient x1="-7.9844384%" y1="51.3784397%" x2="196.60587%" y2="50.9412142%" id="linearGradient-1">. <stop stop-color="#1966E0" offset="0%"></stop>. <stop stop-color="#1D4BC2" offset="100%"></stop>. </linearGradient>. <polygon id="path-2" points="0 0 38.0386864 0 38.0386864 43.9999538 0 43.9999538"></polygon>. <linearGradient x1="-0%" y1="133.161709%" x2="111.409809%" y2="-20.3709623%" id="linearGradient-4">. <stop stop-color="#2684FF" offset="0%"></stop>. <stop stop-color="#002FA7" offset="100%"></stop>. </linearGradient>. <linearGradient x1="43.1021443%" y1="90.4637%" x2="66.1767281%" y2="-0%" id="linearGradient-5">. <stop stop-color="#EA3B3B" offset="0%"></stop>

                                                                                                                                                                                                                                  Chrome Cache Entry: 837

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 text, with very long lines (65387), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):249104
                                                                                                                                                                                                                                  Entropy (8bit):5.316339041710181
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6F43A5762B9B508CBD15841DC84C8C3D
                                                                                                                                                                                                                                  SHA1:A64978A955EF7F46F70453618D9F7FE835A5053E
                                                                                                                                                                                                                                  SHA-256:895F8019624E7B8EE487D3A0C7D0EE40262DC0D873096E8EF3FF159043C55397
                                                                                                                                                                                                                                  SHA-512:B44AC9FF8678BDE58EDBC6808B4BE71B3E55CC58741EED57D569B52B059E007A692C8C0F6FAC49FE3FD7A280627D9ED911DCA41EB388005E8CF652862F212AA1
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/js/other.js
                                                                                                                                                                                                                                  Preview:"use strict";function _defineProperty(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function _typeof2(e){return(_typeof2="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}var LC_API,_vds=_vds||[];!function(e,t,a,r){e[r]=e[r]||[],e[r].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var o=t.getElementsByTagName(a)[0],s=t.createElement(a);s.async=!0,s.src="https://www.googletagmanager.com/gtm.js?id=GTM-WC3GM72",o.parentNode.insertBefore(s,o)}(window,document,"script","dataLayer"),window.GA_MEASUREMENT_ID="G-9ETQKR539E",window.MEASUREMENT_PROTOCOL_API="pLEOJwqCTlq21S9_APATtQ",window.gtag_not_load?window.gtag=function(){}:(window.dataLayer=window.dataLayer||[],window.gtag=function(){dataLayer.push(arguments)},gtag("js",new Date),gtag("consent","default",{ad_storage:"g

                                                                                                                                                                                                                                  Chrome Cache Entry: 838

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 72 x 72, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):225
                                                                                                                                                                                                                                  Entropy (8bit):6.310453908105343
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F691840269B51903595E460BEDEC2F81
                                                                                                                                                                                                                                  SHA1:3530433DE0F422341AD000AF97E89B8CF665FA2C
                                                                                                                                                                                                                                  SHA-256:61D23D2065EC6CB3F3E1B49705EBDAFD402B5B3481178C0A8DAA0737EE005DBA
                                                                                                                                                                                                                                  SHA-512:8CC8EB780A466869EB700DB248A2D24A1EFAAFE1C63B1CF174A89DEDE4505681DEDA2C965BD212F9D1922C7A45DEEF35B2F3F6CE2287BADF284E18DCF804764D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/icon/box-drw-win-pro.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...H.......t....PLTE...............I.............IDATH.c....t..(...8.1.".!.....H..d.,....N..@%.MQ. . .f. V.j..vE.hq+b..LfGA.. ..*...(E.D%<L...Zx8*..!N."..pF..R..Z...I8...0..=.`.....R#.........IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 840

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 327 x 170, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):8900
                                                                                                                                                                                                                                  Entropy (8bit):7.947110668610718
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F61918C5B9F845B23D65C77DBCD13594
                                                                                                                                                                                                                                  SHA1:51D5E6BB3C6C03D80D38E7C8B7676B0F82D67714
                                                                                                                                                                                                                                  SHA-256:69C831BDD62F05490D05611BCEA58F90D96A82D5EBA76FB6E2B52BD724EC65D3
                                                                                                                                                                                                                                  SHA-512:3448125DEAF6EB767651FC82533719D7EF2ACBD2AF552EF0890CC9D0A16187DB3806BC5214AF332E313D829E6D3E7F33399D7030392B738C82142AF8842FDDEF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...G..........:}.....PLTE.........................#..+.....^.....O.....O..O..N........J..M..D..?..Q........<..:...........>..(..B..;..E..8..,../..2..5..^..3..0..%..[..S..X.."..6..H..O..L..U..8..J..;.....Q..V..V..2\.M..P..K..I..F..Z..S..V..T..G....._..Q..a..X.....c..O..K.........}....].....@.....]........D..;.....X..8......p~.................f..{.-z|E^........................4.=.....5Y....%..x../CP..&...4..............p..}..J..3p........Z.........,X......U..@R^...........6^3i.GYr"7E'..3c..@..c......et...p...3w.....n..........*8.szUep...../...\l......'?e...Y.q~.....Gn..Pb..nu7Mp......hp..4|.3F......7.5..}..|..es}..sM......\z.}. v.l.1F....Uc.ox........v........$qu ..f.z.fQ.]<.U..E.z7.....~.... =.....DU...Q..A{.h.kd..#L.|.y..].q8..L?.+..9(....tRNS.........2...}i......pI.on]\!........fIDATx...]O.A..qT....&...j...ZozQl...R...^...@=.3..9..tI3f.,z....9..J.R.T*.JE...Z..P?...iCS.\[. &...FQ+A.;.(..<.1\..Rn..z.M....\.VD..DA...7..m..".l>..V.W

                                                                                                                                                                                                                                  Chrome Cache Entry: 841

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):103198
                                                                                                                                                                                                                                  Entropy (8bit):5.540296801886523
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5723B58E6A8F9D053ABE3E1D0CC0B47A
                                                                                                                                                                                                                                  SHA1:A91D082B34A5DE73A5589C27BC4B86FDDCD4D8A6
                                                                                                                                                                                                                                  SHA-256:2905F0D28A95DA34BF4AEA48332D321C4B67325DE1512CE995C66F19A91C5A21
                                                                                                                                                                                                                                  SHA-512:231380316519A35F3B24943508A3063AB9879698A24B344C38710C0B36BC72360254B9AAB7ABAA00CF1D1021405448BD940C88033B36DA4EB77A16582D75D445
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://td.doubleclick.net/td/rul/1064956115?random=1713902809897&cv=11&fst=1713902809897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
                                                                                                                                                                                                                                  Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j689129974"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j691334967"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j797471435"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j797761798"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7572346854"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7589463467"}},{"action":1,"interestGroupAttributes":{"owner":"https

                                                                                                                                                                                                                                  Chrome Cache Entry: 844

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):106955
                                                                                                                                                                                                                                  Entropy (8bit):5.174814957702355
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4E78C0CFA9BEF89BD05DC605012CEB1E
                                                                                                                                                                                                                                  SHA1:AD6D6CDCC1B23A742C9CB31E0D3A0069F4F4EA3C
                                                                                                                                                                                                                                  SHA-256:A4BAAE7D61EC57D4616AE6D2A68D8AB744826982E5D11C5167FD4F49D63C73C2
                                                                                                                                                                                                                                  SHA-512:22A0203516555F06641AB870E84634D4AF9F8982D2A11911BEFA4820C358C310C52E017D559226704954A876C103F2FA331BC514B15870FA032474CA6FC25DDE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default2/css/base.css?version2
                                                                                                                                                                                                                                  Preview:@font-face{font-family:lexend;src:url(/default/typeface/Lexend/Lexend-Light.woff2) format("woff2"),url(/default/typeface/Lexend/Lexend-Light.woff) format("woff");font-weight:300;font-style:normal;font-display:swap}@font-face{font-family:lexend;src:url(/default/typeface/Lexend/Lexend-Regular.woff2) format("woff2"),url(/default/typeface/Lexend/Lexend-Regular.woff) format("woff");font-weight:400;font-style:normal;font-display:swap}@font-face{font-family:lexend;src:url(/default/typeface/Lexend/Lexend-SemiBold.woff2) format("woff2"),url(/default/typeface/Lexend/Lexend-SemiBold.woff) format("woff");font-weight:600;font-style:normal;font-display:swap}@font-face{font-family:lexend;src:url(/default/typeface/Lexend/Lexend-SemiBold.woff2) format("woff2"),url(/default/typeface/Lexend/Lexend-SemiBold.woff) format("woff");font-weight:700;font-style:normal;font-display:swap}*{margin:0;padding:0;border:0;list-style:none;vertical-align:baseline}*:focus{outline:none}html{-webkit-text-size-adjust:none;te

                                                                                                                                                                                                                                  Chrome Cache Entry: 846

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 49 x 51, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1485
                                                                                                                                                                                                                                  Entropy (8bit):7.859728940130446
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:4FEF590B2F45E9B80926AB187C531A78
                                                                                                                                                                                                                                  SHA1:E7F176377D19823C72B893786B70E3C06B93FDF9
                                                                                                                                                                                                                                  SHA-256:945DF7F1BE91423D84FA7228C3DB950C688713976E8EC9EEB0E792B203FE86F9
                                                                                                                                                                                                                                  SHA-512:02163CD7B819F98A6931B90B0B7199E288A990F2CB70A4858C21FD22233AAB23EE8F75707E740B97723804F705DEE726041177B158F6223626A95289E30A71DB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...1...3......](.....IDATx..mhSW..K.....Y....B..^m...Z..e..2+...v.......[K4.3...h1...:.j.....V....RS6Q3...........ml.ms.e0....<...}.s.yH....o.b..P)t..0.O....U..@8G....:..#S...t.*..u.t.............. Y#...4F.@.z...."..o?.....s.v....5?>.<eV^O....e......z.....O.Kzv.D.......I.!.....=a..!.@..Z.}..=v......4.......Hw..?.M.+....E.j..g.&N..m.........0d.6..o.P..C.....".4i...B..p...e%..".@a.l8G..:....M.~......hU/.AWF@dc3X(.~.9).(..)1>.?s8.D\p......TN{o..M.P..-..#../u..N.3..a.A..M"<6.!4h.....7._,4?.\@..SV.uB...TD..._Q......0..5.J`@U.~=qQ....d.j.#..o...(...$.|f.=....m...g...w!..w.a..jE!...........^...A^.=..A>......}b...}.....Oi1...V.......1>.^$s5.#....%..2'\.G.....$..f.._..A..-.v.x...4...ye..@.....n.$.]....v.U......;.H.*3F.i.a..p'....>[...=...<``..v.H~.-..'.i.......]eKJT.k^qP..>.....pj..E%-mO.9...5..f,..x./..$........=.o..2CC.5i..1b..*..N.YHzI.H.....`..G.@........}...OL.7......V.....-..Z....$%..|..|p......._-.f..s..P......^(..Ja..

                                                                                                                                                                                                                                  Chrome Cache Entry: 847

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 72 x 72, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):433
                                                                                                                                                                                                                                  Entropy (8bit):7.211314635319423
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:67EA1ECEE20C23F2A59FD5A4FE1CDF7C
                                                                                                                                                                                                                                  SHA1:F8BBB724DAD2C7A56405F415F68A19F7E27BC721
                                                                                                                                                                                                                                  SHA-256:F95C1D3DC8685C9B47466D26078E7437EB8D5DE446C4007A9BA0FE71EF4B1B9A
                                                                                                                                                                                                                                  SHA-512:1A996ECBF8CAC88DAE4A35E6E2DA5794F6E8081EA8527BAE3B394426325EBCD8AB8574C9248FCF96EECDE6028F1EB1959F56F5A94F5B31CE94B7F814496171F6
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...H.....b3Cu...!PLTE.....................d..;..-.......=....KIDATx...n.0.D..........t.R.H.....;...8.......H?.o).....H..rDc.(.-.......zD<g.`.. O.)....$....K......?l$d{..~.H.....4.^.'.;...?..K^.L.......43..X..`..#.N.Q7.}uE.`..../..p.F...5....V.c.{.`..l?[0..F...KI.f.PEc."T..B..j.i..Z..Z..O.;o..7jz0.o.l.....g.../..h...........].'$.9.l....."Q#I.{.7B..+l....H.....F.&..nl...$..4..g..........6.G.......IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 848

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (35174), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):35360
                                                                                                                                                                                                                                  Entropy (8bit):5.36636516469766
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:BA9A1ADFA1E88F23290674F7AF1D8943
                                                                                                                                                                                                                                  SHA1:EE5DDA76B2DDFAE82DBF26F375AA5020EDC86653
                                                                                                                                                                                                                                  SHA-256:D69E3CA7AB2FFD6EF6E375926E6ADF82DEEA69005E4EBA565512F8E0D584C40C
                                                                                                                                                                                                                                  SHA-512:82E27B6E544707B85D06616869346DF7AC8ABF029B8FFF266E28B84844413300C9519554858CD56BCAABCD68ECB7695E10E57720898D7E0BABF62D7642C87E30
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/js/globle.js
                                                                                                                                                                                                                                  Preview:"use strict";function _typeof(t){return(_typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t})(t)}!function(){var t,e;window.globle_user_id=localStorage.getItem("globle_user_id"),globle_user_id||(globle_user_id="easeus-"+(new Date).getTime()+"-"+(e=1e6-(t=1e5)+1,Math.floor(Math.random()*e+t)),localStorage.setItem("globle_user_id",globle_user_id));var i;window.browser_category=(i=navigator.userAgent,/MSIE/.test(i)?"ie":window.ActiveXObject||"ActiveXObject"in window?"ie11":/ubrowser/.test(i)?"uc":/bidubrowser/.test(i)?"baidu":/tencenttraveler/.test(i)?"qq":/maxthon/.test(i)?"maxthon":/Chrome/.test(i)?/OPR/.test(i)?"opera":/Edg/.test(i)?"edge":"chrome":/Firefox/.test(i)?"firefox":/Safari/.test(i)?"safari":"other");var n;window.operating_system=(n=navigator.userAgent,/windows|win32|win/i.test(n)?"windows":/macintosh|mac os x/i.test(navi

                                                                                                                                                                                                                                  Chrome Cache Entry: 849

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):1943
                                                                                                                                                                                                                                  Entropy (8bit):5.279434929656858
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:050401A6545078A84F458BAF1424CF88
                                                                                                                                                                                                                                  SHA1:AD144ADE89A8D0E6800C643A1E5933842A3DB08A
                                                                                                                                                                                                                                  SHA-256:7B8D7E030AF444EE5E911458F97ED17834EF043CF5FD61995EB43524E9769CAF
                                                                                                                                                                                                                                  SHA-512:56F3EE7BB314D98DE4475E29440E6493BE3B3B2DAD668BCD2C8BE98EB1B1AF79D6C69A4EF4A98D9EB670FC29263F7B5107C868783714CEC480E3CFABE27D89F4
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/index/header_2022/arrow.svg
                                                                                                                                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg width="36px" height="16px" viewBox="0 0 36 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. <title>.. 3</title>. <defs>. <rect id="path-1" x="0" y="0" width="36" height="16"></rect>. <path d="M9,15.9964095 L16.7365946,7.5970739 C17.4849327,6.78463078 18.7501959,6.73266341 19.562639,7.48100153 C19.602902,7.51808757 19.6416254,7.55681096 19.6787114,7.5970739 L27.415306,15.9964095 L27.415306,15.9964095 L9,15.9964095 Z" id="path-3"></path>. <filter x="-54.3%" y="-70.5%" width="208.6%" height="290.5%" filterUnits="objectBoundingBox" id="filter-4">. <feOffset dx="0" dy="2" in="SourceAlpha" result="shadowOffsetOuter1"></feOffset>. <feGaussianBlur stdDeviation="3" in="shadowOffsetOuter1" result="shadowBlurOuter1"></feGaussianBlur>. <feColorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.197060752 0" type="matrix" in="shadowBlurOu

                                                                                                                                                                                                                                  Chrome Cache Entry: 851

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 27 x 24, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):272
                                                                                                                                                                                                                                  Entropy (8bit):6.982322421380122
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:5747088DC9F944E3867DFFE025FDEC16
                                                                                                                                                                                                                                  SHA1:1D43CFE00281A4BB2E9FCF71B0893F3E4091B7ED
                                                                                                                                                                                                                                  SHA-256:167B24BB53EC21927AE3F050D6B78D97E876281636D5BCACC79D8C6A2E45E968
                                                                                                                                                                                                                                  SHA-512:FEDF93FBCC9ABE164E3F30DD3D9D0ADD674833E0CC015D380246077AC8CF4DFD65B8047880A0B6693A1286E31E00588FEE6D30D4DF373441FD634198E3839187
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR..............INp....IDATx..Q.. .@.@.....D..).@..@.....F...A......ow......w0..q.>".j..#...=.`hI.+g....1.9X...a.2.9sC.g......K.E.f.L..S....2...zm...E2+..Wy..aMq.8OE*.g..S.\....u....B..H....g&.......<.t...1..KM.i..Z.........D..p*.....IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 855

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):44
                                                                                                                                                                                                                                  Entropy (8bit):4.359286801442599
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:F2B1A2987370C56BB74EC48E145AA5F1
                                                                                                                                                                                                                                  SHA1:7514535677259F10BF86B255E4AA6E36F852636E
                                                                                                                                                                                                                                  SHA-256:8FC574E33D0059C3E1FD76F1D1194F8DE148E36B786F193F82BCDFE50D7EC6F6
                                                                                                                                                                                                                                  SHA-512:E0A2966A9CECF25873CA4BD0DA92EC811411EC67702E03069DDF99770C8E484A9B43D21C353492FAE2CF71BFC84480F4357B7842F00FA404FFED52538906DFB2
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwkUWxz0SSuIBxIFDbbRMj8SBQ14bxIZ?alt=proto
                                                                                                                                                                                                                                  Preview:Ch0KBw220TI/GgAKEg14bxIZGgQICRgBGgUImgEYAg==

                                                                                                                                                                                                                                  Chrome Cache Entry: 856

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Web Open Font Format (Version 2), TrueType, length 29140, version 1.0
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):29140
                                                                                                                                                                                                                                  Entropy (8bit):7.990085373456572
                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:46AC6E04B670ECF94AA433CE03F7D74B
                                                                                                                                                                                                                                  SHA1:2A5A5E9A810D0CABCA36514B852BC5407993CF15
                                                                                                                                                                                                                                  SHA-256:56472BB280B5341B9C7CA9D3B2DF0A24DDB4E0F726F34D02AF2643695B0BF8E9
                                                                                                                                                                                                                                  SHA-512:E10BEA27034539E85D7B341A1FA0AC828CA4F716FBD16AEB78D886480505EA743AAC789967B6423D3C0B61790FD90514839430BA81975386BF41F08A88347D2D
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/typeface/Lexend/Lexend-Light.woff2
                                                                                                                                                                                                                                  Preview:wOF2......q.......4...qn..........................,...p..x.`?STAT*........p..}.....6.$..4. ..p..k..[H.......E3M3...Z.N4.P".[?.....{f_sf.F.V........Ic...m..DP........na..|r.U&.|.P...d....!.T.e,=..p.7..eyH..Z.q.%A.^.n...&|./.....[P...%....X..~...a..UT..O..!/.......6.M.V.F....._og.d.d..3.........N.Qr....EWT.x.\...[O.y...,....S......|..|kg..W...E.hrGa......t.g...|PON^..E!".U.M.Y..{.<l..<p...JT...m.zs..v...w.p....$..">..5..<>.....`.M..c.U`...N.?.....`+.MJ.p.b............Z.R[...Y..........iC.[. ..s.mp......`.cY.....(ea.)...U`...qw..Ygd..Y.........?...\!)..}e.......a..EQ...M....N...J...z.{.+C.D...s.m.<.?.-E3....%.-....=.....)..m,T@..Ww...}..1...#@L........Y..L.#...`...9sB......../.AR.L..1.,.4h.I....P3z=....d..6.T..&.../.|....^.s..4s..u<.....r......K..|.?.\.vW.Je.H..1.O.......s...Ei... Up.?.<`O0...sf?.....q.6.....m.jM&._.Bzh.OLB.....+..\._..vXv.p".?.....R.I....>.9..2..........=..+.J...R.....h..Y-....j.^._........P....y...Z.. ...z...L....{

                                                                                                                                                                                                                                  Chrome Cache Entry: 858

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2923), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2923
                                                                                                                                                                                                                                  Entropy (8bit):5.858822472511773
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:AB0725E8ECCBA112BA6A502484AC2B4B
                                                                                                                                                                                                                                  SHA1:0FB91E9CA55B45DACC16D1F411CF58E9AEB98289
                                                                                                                                                                                                                                  SHA-256:CCDB49087109DF55893A8220190D7C2C48203304F44B1FA2392F3E4B77FDA1D8
                                                                                                                                                                                                                                  SHA-512:6A3826E8D548CD8B5441A204619D0988626F5AE6D338349CCACAE0DADC45B15233C34BCBECA8303C5865E4EFC4EBC0F8BB9F2FE627D1FBA1C82736B4FC8A450C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11113079898/?random=1713902832147&cv=11&fst=1713902832147&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&userId=easeus-1713902766609-213268&did=dMzk4MW&gdid=dMzk4MW&npa=0&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_free_win%3Bevent_label%3Ddownload_popup&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 859

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 258 x 307, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):9356
                                                                                                                                                                                                                                  Entropy (8bit):7.911741619278641
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:215EDB9FC5BE472853475F08F6C578AA
                                                                                                                                                                                                                                  SHA1:0A7882C844512F655CBF86619B97AA73A003A433
                                                                                                                                                                                                                                  SHA-256:BDDEB9E05AE7D37ED1E7D1CFB8B26FFBB740398F11E7E5B72686252661CFF034
                                                                                                                                                                                                                                  SHA-512:5C6451BC30BD629E6ADCC6A31A652E13E98B7FB72357F3FBE3CA6CDB438D9964AB049EA63C40BB8BF3E33A7D41CA8F732A5465C8C7E0B5CBB453B0E2B092A8D9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/tb/index/2022/solution-7.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.......3.......j....PLTE................................................................................................`m~.........).....Uaq.....................7....7..S`p6..:........9..iv..../.....5..Vcs3..6....T_o...4..O......~..A..S_o......L........S_p.....#.........O...T............o}..................o..n|.h........E..T`p......9..............g....................q..............Rh.!...............x.S.....V....."..... ..~........Oe.Mc....'.............. .....J........................................................".............%.....................9....l...........b..s......$Dkw.@M^KVf7@R-5C]s.!&,O......y..%~......D....:..Wl.0..@..d{.}.....Ydwan.........x..X..=........u.....g..[.....+.......V.....;....'q....a..I....0.......Aw.#.....itRNS.......... )1.&."+47.$:>A<E.+..5.~.^M!....`.....5...R9M...x._.....xp.oZ.....>......6.I....xo...._..... .IDATx.....@....d...]....).^. ,..na.E."..T..K.........M....";.?&8.....

                                                                                                                                                                                                                                  Chrome Cache Entry: 860

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (532)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2120
                                                                                                                                                                                                                                  Entropy (8bit):5.475321660491406
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DDCB981B1555F3011E3D550508DA75A8
                                                                                                                                                                                                                                  SHA1:305978A0C5924B7E34E1DA42914156079C8BE631
                                                                                                                                                                                                                                  SHA-256:E9F67688FEE0150690C92917640AA09F8A80D6B6366B90113F0C5772DFF669CE
                                                                                                                                                                                                                                  SHA-512:F7B7D124E0717C8DDDBD1653649934FFFCB4D613F317CE65A8F8F2A6B2A0C978930C6C1969F96B993C6021D83753F7140A23FF992D35CC865D62C69C015456C8
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://mc.yandex.com/metrika/metrika_match.html
                                                                                                                                                                                                                                  Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta http-equiv="Content-Type" content="text/html;charset=UTF-8">.</head>.<body>.<script>(function(){try{(function(){function l(a){var b=a.document;if(b.hasStorageAccess)b.hasStorageAccess().then(function(c){a.parent.postMessage("sc.sar*"+(c?"1":"2"),"*")})["catch"](function(){a.parent.postMessage("sc.sar*c","*")})}function q(a){function b(c,d){var f="sc.topics-response*"+c;a.parent.postMessage(d?f+"*"+d:f,"*")}a.document.browsingTopics().then(function(c){return b("1",JSON.stringify(c))})["catch"](function(){return b("e")})}function g(a,b){return function(){e[a]&&(e[a].timeout&&(clearTimeout(e[a].timeout),.e[a].timeout=0,window.parent.postMessage(["sc.image",a,b].join("*"),"*")),e[a].g=null)}}function m(a){try{if(a.data&&a.data.split){var b=a.data.split("*");if("sc.images"===b[0])for(a=1;a<b.length;a++){var c=b[a];a:{var

                                                                                                                                                                                                                                  Chrome Cache Entry: 862

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 72 x 72, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):465
                                                                                                                                                                                                                                  Entropy (8bit):7.289215124165457
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:38F01281CAEAE4CBF44EE1BDC171F264
                                                                                                                                                                                                                                  SHA1:658ED221D1A0907A844A8D9A80D5B615A22DBFDD
                                                                                                                                                                                                                                  SHA-256:33A60376426CE7ADEBEFFB56E1E19F1E50608C7019BAFEDB4E2FF0FE563888F7
                                                                                                                                                                                                                                  SHA-512:C534551673CCCD76D833B9368CCA3829C475B555B8C7E2174C7B45FB9AD10D31DD28D72A9451A8C48790D6FC8A17CADCF4D598EBD7C42AB1CC046A642EC7698E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/icon/box-pctrans-pro.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...H.......t...!PLTE......-..;.....d..................z*....kIDATH...n.@..'R...........C.U..1........@...d~H....=.':.|a..gvi..W.4m)....:....^(!Zr....;.s...:..^.....Z10.Z..:M`l.tBt........]....1..qB0&!..GQ.\>....vb..l=`7..L......J....9:I.a..NZB..U.L..^....Y.......Q:.|....8..!.......X..[.."....{Ji....k.zS....E..~..~.....X-CA......l..gBh.k...y.R.@....-\..H.q.p0!.i...}.l............2.n./.H...n.........Q.~.o_.b.........IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 863

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 435 x 48, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):342
                                                                                                                                                                                                                                  Entropy (8bit):6.8770171837261795
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E700318A7C78953E597C01FAEE7C9AED
                                                                                                                                                                                                                                  SHA1:5988B09EFCB242F657CEC7E53150BA9EA45609B0
                                                                                                                                                                                                                                  SHA-256:E57455B4EEB9D54BE73BD8791D65FD28235FA127A5443871FFA3CCE768FE0253
                                                                                                                                                                                                                                  SHA-512:AD285FD805920D5747A0E3FAF6B314CC36E6BFD9B4BF0BF500E9E1F04309844237305E4ABAB209ACC10BDBC990792CEB3FE6408131659ACA55C2AEAB28F5C4CE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR.......0.....i..v....PLTE.....d..d....d...O......tRNS.M..T.KS....IDATx...... .D..I..(.E.... J....Y...s<.W.9X...^...&m.&m.&mX.Q...}.....dMZ..$....i..(H3>U=Z.S...Kr..RV.%.......h..(E3.U%Za[.....h.}Y....dh...-.].......WZ....F........uve..`6W.5.q^.R4/..h..7Z..h}.M....z...KM..y9..9AC..dI.'..I.......?.......fN.....IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 866

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:C source, ASCII text, with very long lines (48275)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):48503
                                                                                                                                                                                                                                  Entropy (8bit):5.222613194655436
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B524230F01284E88B7AE7F2A45B64C89
                                                                                                                                                                                                                                  SHA1:7EDFD2FAB91BAA411902E8F8CBA32348C64DCC9E
                                                                                                                                                                                                                                  SHA-256:CFC3D0E832316EA085BFFEE5D69409502CD0DC24F9D327ABD072825F9D6C8A63
                                                                                                                                                                                                                                  SHA-512:0EE8B28B314B9BFF14B7FF4EB19D732A247BA89D46A1EE4844454C9E019C68EAA5C0304C83C6C826D56A027EBDE230E5476FDFB28998421F514EB1D46FD00568
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://dynamic.criteo.com/js/ld/ld.js?a=104435
                                                                                                                                                                                                                                  Preview:window.Criteo=window.Criteo||{};window.Criteo.oneTagConfig={partnerId:104435,visitEventEnabled:true,fpIdentifier:undefined,waitForGum:true,dynamic:!0,gumDomain:"gum.criteo.com",privateModeDetectionEnabled:true,blockedSteps:[]};.!function(){"use strict";function s(e,t){var n,o,i=null===(n=window.Criteo)||void 0===n?void 0:n.oneTagConfig;return null!==(o=i&&i[e])&&void 0!==o?o:t}var u,e,l="5.23.0";(e=u=u||{})[e.None=0]="None",e[e.Cookie=1]="Cookie",e[e.LocalStorage=2]="LocalStorage";var a=(o.checkLocalStorageIsWritable=function(){try{if(!window.localStorage)return!1;var e="criteo_localstorage_check";return window.localStorage.setItem(e,e),window.localStorage.removeItem(e),!0}catch(e){return!1}},o.checkCookiesAreWritable=function(){var e=new o("criteo_write_test",1e4);e.setValueWithNoDomain("1");var t="1"===e.cookieValue;return e.removeWithNoDomain(),t},o.prototype.setCookieRead=function(){this.isCookieRead=!0},o.prototype.setValue=function(e,t){void 0===t&&(t=!0),this.cookieValue=e,this.

                                                                                                                                                                                                                                  Chrome Cache Entry: 869

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):251642
                                                                                                                                                                                                                                  Entropy (8bit):5.262639275280972
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:620F2F869D808F708387A8B94710670E
                                                                                                                                                                                                                                  SHA1:DDD6EB682101BF3730ACF1F333E1BC976DFF7789
                                                                                                                                                                                                                                  SHA-256:B26D82B102515BC4F2168A5E66071686908E554AB890749BAB563EEA93992DD2
                                                                                                                                                                                                                                  SHA-512:5AE55459BFDE12D9182DDF94C5BE75B662353C42F2E37D872CCACAAF8088F93A6628CAFF3C1069B278C7DF903468B14AE189E234EC49E5AEAF73868C6D914649
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/js/lottie/lottie.min.js
                                                                                                                                                                                                                                  Preview:var a,b;"undefined"!=typeof navigator&&(a=window||{},b=function(window){"use strict";var svgNS="http://www.w3.org/2000/svg",locationHref="",initialDefaultFrame=-999999,subframeEnabled=!0,expressionsPlugin,isSafari=/^((?!chrome|android).)*safari/i.test(navigator.userAgent),cachedColors={},bm_rounder=Math.round,bm_rnd,bm_pow=Math.pow,bm_sqrt=Math.sqrt,bm_abs=Math.abs,bm_floor=Math.floor,bm_max=Math.max,bm_min=Math.min,blitter=10,BMMath={};function ProjectInterface(){return{}}!function(){var t,e=["abs","acos","acosh","asin","asinh","atan","atanh","atan2","ceil","cbrt","expm1","clz32","cos","cosh","exp","floor","fround","hypot","imul","log","log1p","log2","log10","max","min","pow","random","round","sign","sin","sinh","sqrt","tan","tanh","trunc","E","LN10","LN2","LOG10E","LOG2E","PI","SQRT1_2","SQRT2"],r=e.length;for(t=0;t<r;t+=1)BMMath[e[t]]=Math[e[t]]}(),BMMath.random=Math.random,BMMath.abs=function(t){if("object"===typeof t&&t.length){var e,r=createSizedArray(t.length),i=t.length;for(e=0

                                                                                                                                                                                                                                  Chrome Cache Entry: 871

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 275x210, components 3
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):13795
                                                                                                                                                                                                                                  Entropy (8bit):7.9535607580472405
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:9101315A9D64233A20528D935162A011
                                                                                                                                                                                                                                  SHA1:BD0AB142A6B4FD1BFC0AB5772D63D5EE5AEEE451
                                                                                                                                                                                                                                  SHA-256:D3243AF43A209345504D4D53C5B8B7E4CAC38C1CF97FB088B9B0E6481A8941B3
                                                                                                                                                                                                                                  SHA-512:5D192BEA895E0692E37B9B463BCC5B00B5761840FD3C366F509925162EFADF4D64747962F342B8A8406AEB05A73903A80A5AAE5AAF1CDE0FC43C48A288DEB0F7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}..........."....................................................e..LvS.>.|....^5..$!...u...u.!..V....;X....l.>Y....G./...hR.L...M.5$.....5..p...d.x...)...j.-am....A.-E[5.3.j.$..1...}P..-......F.j.Ek2M[5...k.H6.,Z..\..M.B.q.......|..{.".h&0.....\|..T....jj..iZk..M.s..8)..$..Oz.Yk.W......Ba..g..FKW.aD.bG..a.:.e...Z...2..bk.........{Ha..+.z......|..i\...?[:... Y..0.Dy.o.....iY.:].t.......l..@.Y.p1........sOh....n....:...X. Y.}.......Fk.t....0............%...q.....Y\...O+A.U..wA.]&E.&...A...Y. .....H.8....-ja....J.*:.K5..5.>...e}@..m#..}{.@Hq.c.s.PRu.GQB..?.....er.67=....#....,..i#8Ps.{d."...O.%.|ra....2..GS$.6..^(9./_....4.SJ..P....~Le(.#!...3k...#.&....x....yU.....Ts..~..............q.n.D....Ue\wAL5..XY.7G(.f.u>.n6.V....K....^'HD...xi....X3.n.[..hj..[..i...<..[...-...O......^...w............

                                                                                                                                                                                                                                  Chrome Cache Entry: 872

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):43
                                                                                                                                                                                                                                  Entropy (8bit):3.0314906788435274
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:325472601571F31E1BF00674C368D335
                                                                                                                                                                                                                                  SHA1:2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
                                                                                                                                                                                                                                  SHA-256:B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
                                                                                                                                                                                                                                  SHA-512:717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://sync.mathtag.com/sync/img?mt_exid=36&c7649636-901e-4830-9a08-9606a0ac6894
                                                                                                                                                                                                                                  Preview:GIF89a.............!.......,...........D..;

                                                                                                                                                                                                                                  Chrome Cache Entry: 874

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 321 x 161, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):11993
                                                                                                                                                                                                                                  Entropy (8bit):7.96666797147799
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:264A2E02B910AD990CA857BB17144079
                                                                                                                                                                                                                                  SHA1:B3D1DD015550A7505EEC494066B6F75CBA09A3F2
                                                                                                                                                                                                                                  SHA-256:6A736D91FFA9A486FF4AAF5BC537EB8712E5E0B52C961982B2A7B11F7D3DD883
                                                                                                                                                                                                                                  SHA-512:4A572457B57F418CAC4C4533709D1974DDDAB285A3528D2A1427414622C1FEB33272B2C0C8C745B93130ED015D4E3009B7681DBFE9E505DFB2F562BD672E14E5
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...A.........n..5....PLTE.......4.........#........'..........lr.~..lu....ow..#.]e.Xd..........q..~............................................p.......................?b........................................................................................................................................................................""#...GL]...ak...............................JPc............?EW.........T[r...9=L...\e~........m>BP......^g.58D.....nYby......fp......lRYlFIR...W_wMUl........h...9........9......./2?...............%&+nw........q.........H..+,4....u}.OTf..............v.......[......E..}.......sv....]...}.........v.......R.........T....V...kms..f......[]b......m.........W+.......n.....#....}9.s.z].xf..g.Z.mCuF.......g..6.~.G$...;J....7tRNS.............0#(.5.......3?.D......N......W.F(..\d.}e.*]...+TIDATx..=..Q.............Q.p>...0....b..........TD..QP...O./..b.....{.w...D..p.y^...E...................../.w....

                                                                                                                                                                                                                                  Chrome Cache Entry: 875

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (14590), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):14590
                                                                                                                                                                                                                                  Entropy (8bit):5.123657949323105
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:87F7E3570A5B1D8FA90C9E815A00D722
                                                                                                                                                                                                                                  SHA1:D34AA294C016FB4DE46D9E669FDDBF33F5A5BC58
                                                                                                                                                                                                                                  SHA-256:44CAAF1FD168B5A8A1028AB5ADEE30744E0A418896B9D2A3910DC4BD79C8B35E
                                                                                                                                                                                                                                  SHA-512:E99316A72952F75B090404644C39B9EA003C852F95BE55B17DD3A5256CBD36651ED68D9951B19BD66A55121C32B3B1ACD11FB9C7AE8DEB122695E4E89157DF87
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default2/2022/css/globle_pruduct.css
                                                                                                                                                                                                                                  Preview:body .globle_button_2022{background:#3575f5;box-sizing:border-box;width:220px;height:56px;line-height:27px;display:flex;justify-content:center;align-items:center;color:#fff;text-decoration:none;border-radius:30px;font-size:18px;font-weight:700;cursor:pointer;position:relative;overflow:hidden;transition:background 400ms}body .globle_button_2022.hidden{display:none}body .globle_button_2022>*{position:relative;z-index:2}body .globle_button_2022:before{content:'';background:#518afc;width:100%;height:100%;right:0;top:0;position:absolute;z-index:1;width:0%;transform-origin:right center;transition:width 400ms;border-radius:30px}body .globle_button_2022:hover:before{width:100%;left:0}body .globle_button_2022 .iconfont{font-size:.85rem;line-height:1rem;margin-right:.3rem;text-align:center;font-weight:400}body .globle_button_2022 .b_w{min-width:150px;line-height:24px;text-align:left}body .globle_button_2022 .b_w span:nth-child(1){display:block}body .globle_button_2022 .b_w span:nth-child(2){font

                                                                                                                                                                                                                                  Chrome Cache Entry: 876

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):4620
                                                                                                                                                                                                                                  Entropy (8bit):7.9514580272926585
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3CE991F90DF72FE6CF8DB19930682816
                                                                                                                                                                                                                                  SHA1:8202420A062D1D8F72FFEF129780DE44D14FF69B
                                                                                                                                                                                                                                  SHA-256:29D40801922607C0563601EF6B3C30E595E13A471B580E473F6A4FED6CFC76D3
                                                                                                                                                                                                                                  SHA-512:5510FA942F978329B5EFD9FDC2A87BC337B0FB56DE812034157FD836DEA22C95F3028CF72333F7498B3232E2E964C7B03FD8C0B2ABC2C9F3314459D02C51FF4F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/index/header_2022/home-bottom-slogan.png
                                                                                                                                                                                                                                  Preview:RIFF....WEBPVP8L..../......$E..c..?w...$Gb.....oi1.m.@t.n.u.U..l...m............m..y..m.d...Pm...?.....`............~3.....@.....%|e ....@@.7.O........<.m/.._>d.....)@..._rJ.......k9......J....bh.x....kW....MT....Lkve.^...T(N}.9....Q.a"-T.>g..Q.O..3......F.YeZ.*R..Q4.M..|w)D-D..-h..!..j.!...a.9.@...E..`.r..V.......5a.Rk..............l".."...2^.....n..yV.Vn.J..Uo;...'.:.%.....5z.Ow..W......C......o}.!"&.[.v...Mb._ a.J...D.).F.. ...)....n...?.dwE...hk..&..C..f...(.........H5 N..J'R...@...#.?.......*.C.uhn4y.2*..'..t.Tz.v....`..uD.'...mn..T..^E. p7.Y.0C*8...%=qr..p...yD.'..^...l..{xx||j...N..}~y}{{.c...F.d...Y....|..&.[sEU#..1OVi.3..6..s..fq.sd.fr.....0GTi&.?sDXF[Z..v..d"......mmE..H..f......[.........'.].}......R..rq.P...ZD...}$... .%j....._.;Z...{...n.{..F.KM.Cf...A.Z...g.Q'.....Y....o..\>_(......ONJ.r.Ry...$..5.m+....z..Z...C`...h.2.[dc.....4...1T..r...Db...Uj..%..E.r.Z1h.....]K.....&......=.b..,.\...."^Ot..^.}gcQ...&1.V..do]p..

                                                                                                                                                                                                                                  Chrome Cache Entry: 877

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):62
                                                                                                                                                                                                                                  Entropy (8bit):3.9237100146972455
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:3F386F5061436A0338A64E0910DB495D
                                                                                                                                                                                                                                  SHA1:599FE4A552C991A2B3CE5A1660732BF7B21FB901
                                                                                                                                                                                                                                  SHA-256:0AF3AAE90B7DE9FDCEEE2AB421378EA2F54C74BE81EF43FC6C1790A032755D80
                                                                                                                                                                                                                                  SHA-512:235479F42CBBE0A4B0100167FECE0D14C9B47D272B3BA8322BCFE8539F055BF31D500E7B2995CC968EBF73034E039F59C5F0F9410428663034BF119D74B5672C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://tags.bluekai.com/site/29001/sync?3rdpartyuserid=ISVL26Rxr-cVw5k_yMh1JBcX_RHlzyRw
                                                                                                                                                                                                                                  Preview:GIF89a.............!..NETSCAPE2.0.....!.......,...........L..;

                                                                                                                                                                                                                                  Chrome Cache Entry: 878

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 241 x 939, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):1894
                                                                                                                                                                                                                                  Entropy (8bit):7.316267356377015
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:1966861F1F83F8AFB5F2951FEF0BFCDA
                                                                                                                                                                                                                                  SHA1:A540E9D3E9368E89266BE495A57BC02345264F8B
                                                                                                                                                                                                                                  SHA-256:062553D01576F01548F250D04027E9BDC647A84FF5922C366A7D8C75860F7A02
                                                                                                                                                                                                                                  SHA-512:EC2F63E5F73CACDB8589F77941F8CA904A1DFEFD39D1A1F543B155F16F05654670D58A2038C569861B732448358927B90DF41588582461772D5A6752DA8118C7
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...............7...HPLTE...............m..YYY...........m.....UUU..m.......///.........(p.]]].6......tRNS.'&@Vko............).=z....IDATx...j.0..`.(X`........3\E..M,...-...$h......'cG?..9a..S5e.......Xm7....f...X...,u.Kj...4......%J..(r*i,d..J...Ws(..e..O..P...Cac...+.:.%6S"....8.>..Z.....4..&.m....f.G..G..bS.35.Q...$qJ.T)...r.~.y.r....=.X.L....[.q*M..Zb....+....l...3..8h....<^&."{e.Y..q........&....B...;..H.u..9h......,...*.S+.[.....t..Q`.A..q#7L2..cb..9.....F.L.).J...o.FL..i...=.gO.U..=^vG.D.".....t.N....<%...}ed...N.D....2...Z.........................\....Gw1.^.....;.-....~."..-...~.".!..7J.i=.<r.......{......z.I.....+....|.'6.W.c................k.nv.:.(./....<q.....F.1i.c.iT.`..z..3..f.b.}....X.{...%K....<...3.,X0...................y..b..+V.X.b.?Q.\......k..Zp.....e.?.u-8].N...t-8].N...t-8].N...t-8].N...t-8].N...t-8].N...t-8].N...t-8].N......:.?^..r.Zr...%7k..Zr...%7k..Zr...%7k..Zr...%7k..Zr...%7k..

                                                                                                                                                                                                                                  Chrome Cache Entry: 879

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):43
                                                                                                                                                                                                                                  Entropy (8bit):2.7374910194847146
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DF3E567D6F16D040326C7A0EA29A4F41
                                                                                                                                                                                                                                  SHA1:EA7DF583983133B62712B5E73BFFBCD45CC53736
                                                                                                                                                                                                                                  SHA-256:548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
                                                                                                                                                                                                                                  SHA-512:B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-NSCpRH7SFkuR3iGMtOHNqjTloLL8j760AM8g7w
                                                                                                                                                                                                                                  Preview:GIF89a.............!.......,...........D..;

                                                                                                                                                                                                                                  Chrome Cache Entry: 881

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 21980
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):6759
                                                                                                                                                                                                                                  Entropy (8bit):7.970766444142892
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:15864CE88FA79A3E954417D0C3396798
                                                                                                                                                                                                                                  SHA1:FB9C3441942954B8EF8D637CDB307CBBAE25DA56
                                                                                                                                                                                                                                  SHA-256:97FDE46829E88416162D1CF2BA9C0BDC0A5C45D826ECF44095782AFD7417C500
                                                                                                                                                                                                                                  SHA-512:AC2B648224C8DD20F4BF5DAE9A4347C57B9902AE554E84FD3506F8B3B1E7759B33CB937B04D509E1DF06E4CBBF133C09D98A06E6FE8D30F639E4B8619E778697
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
                                                                                                                                                                                                                                  Preview:...........\.R.H..?Oa4.niI.....L.EO.Q.....,A.V.d...H.h.'...H..{N..%.zf"f#.....'..;'..?.....y>.....$E..%./...l.o.7.V=q..%):,.LS/....q......v..a.}......".0.t..`yf.2]&.....8........&y.Eg..3..<...M..}..A8.).....?~8..xy}.....{..Y.K.........%....n.Q.e>.u.1..a.zA./..oo.........CN....5.d*.cX5R'{.u..{....3.O...nn.._....,e./..M.H"......R.l$.....:.aJ.L.S.g...>#...-/$.<.g..i..[....O.............^..?.6...........g.u...............w8.w..v.=...........qog.w@..n.....%Y,o....r....%5Q......\..%Y1......!..SZ$....yyz....%...\.o.'I.1......`B.........>.<X......E......#..^..eP.....,`...E...H.4..G.v.T.A.J.Y...,....x.......!.B&.6...~0.....9.*|....4.HB.K .......,..J....!.\5+p.......94O...Ar....?..+K...>L7R..s...&.v.=+.{I..M.....D..Q..\T..%..H.....Qt..P.X...L#.g.H......O.xlu<X.........pD.lJ......(..!...V..E%.4N...z.J-...o.".~...BC....T.Qf.@..p...fS.../.R.....;3.a2.e.~>.2`Z.A..R$.X.......KZ|..y.ei.GrI..d..P...e..d......(..(gF>k.P.>.H~.Wt...dP.KY.*".....{C515... .v.

                                                                                                                                                                                                                                  Chrome Cache Entry: 882

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 840 x 56, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):852
                                                                                                                                                                                                                                  Entropy (8bit):7.519199563724502
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:72C0033917E620F5988DD52F30474BA7
                                                                                                                                                                                                                                  SHA1:E945B3DBC7A8640438755852FDA8D141CD39F822
                                                                                                                                                                                                                                  SHA-256:FFDAE7D38AD24F417CC9A852D8553FBD5B07C112E5A715168636EDAC5522A09F
                                                                                                                                                                                                                                  SHA-512:45323A03CDB1BA42F939EC9D5E9C21E8B8B01411F3C8FCCB19E630119595DBE018AB25B43BD8EA6D90FEF2A9D6DC0C26F49D9ED23964457789C595F8F5775D9F
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...8.......(....?PLTE%2i.....f `.+e.+d ,d ,d ,e.&`&2h&2i#/g -e.*c.'a.&`.$_."]..[..Ys[#.....tRNS....4......P.......IDATx...r.0..W.a;...!.?k*rUR..1..(l7W`.x.!!...O/.......?.o.3.y.<...G.$...Wqz..Q..... .{r....K.mc.w.S.$...3Fb.6. ...i..H......iv..9....G9.K......!....9b F..Y..(e...V1.7....i.......D0.6..@.=....n.....Tc.|.2.TUS.H.._.#1..T....#.w.......~.T..&..]s&F..-..0.6z..Y..'~..6.-....)...j.!...d`}..N.o.S......uE..=.`.. F.`}.+...6Z....H..{..K..V.....a....H1..... )n...}..f.f....Vb}.B..E.vOA..,..v.e.."b.F.X_.E.....^.1j.......6..k...0.6.N.K....#a#......#a#...F../1p..`..F..f62`...I.h:.]R.+0.6.....z....>...b$.n.Z(6.H......0.6b}.P.n...X_/..n.D.M....W.......l..8.J....a$.Wbd@..0.6b}5...H.H..........F4u...#....Ou...#a.Y..:...#a..bT.^G...#......o....]..bD.j6.H..sc...+.a$l.BQWg.....w2......z....IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 883

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 72 x 72, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):311
                                                                                                                                                                                                                                  Entropy (8bit):6.835047568101281
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:ED195B87D86D81B100F84168056AB292
                                                                                                                                                                                                                                  SHA1:E4C877162859E02C3DD3EBC5612BD338862D33EE
                                                                                                                                                                                                                                  SHA-256:8F45BA0331BB68DEBD918F50EF8F85E7C3E42090913E53AC96AE090012C64DCF
                                                                                                                                                                                                                                  SHA-512:0646F970092C2AB4638A599AE6F7EC0C3C474C0B25FEF9DE1E58679498170D524C37F94F46EEA40FDC286AB24F94DA531BCCD68E4D058CDCBBB11E2785B3691A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...H.....b3Cu...!PLTE.....................k..T../........V....IDATx...A..0.D..hL...<.Q....H...Q.K.V..4.,.......CN...."..H.#.....uXb.%v.e...H..H..K..K.d8 ..I.x..K=.Q.a......L..=~6..K.xQ..u...R&.T.Z9C.E$t.F..:..GR.0$p@...a..y........8...K...;,.cK..8.$.'.g.j..c..p.........IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 884

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 109653
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):30335
                                                                                                                                                                                                                                  Entropy (8bit):7.990842916031374
                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B60E7BB65B85844B76E600948CAE3C45
                                                                                                                                                                                                                                  SHA1:1229C7312A03BFB4FF9639438D2481DC785726F3
                                                                                                                                                                                                                                  SHA-256:95198186BCC7CD59F26C687249E999070F4D7A57D54700928FC4D4352229469A
                                                                                                                                                                                                                                  SHA-512:C55666ED68C1229F237FC02646E25465A1D3678C506A27649AF640D416754CE50EB785D162E258B66426A911491955971244E1B0E506A4C87E0FA7C3D2B7BE77
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://widget.trustpilot.com/trustboxes/5763bccae0a06d08e809ecbb/main.js
                                                                                                                                                                                                                                  Preview:...........}...y'.U x.!. E.h.}%......iwt.du.j....[.-.3..w.u.>7o....:;N2...I...N.sV..5_ae....W...^.....5..s..5..z...*.??....3..{.o.%..|...J...'.n..o._>.u..F.7UU....,.5B.......ujC....7B..P+...z7...Q...X.g...0..y... 6v=.hL..l.W.x.|.,...`.....q...;w.?.q..;.....}.r..=..a.9'.EC.mW..x\....R.(a.r@Q........<.B+m.Z.SsY.zR..]...3>.v,....Au...x.....Q)@..u5.y..v..AZ...O.Y.(..Al...y..qu.&v/..,..J.e>x....k..5..s.6.....o?......M.....-/.oNh.l.y..9.N..V=.....\.....(....u.*..}{=..{....HM9..9Yn?).F.ahx...?..8 TVGnt..WS.+.././..V..w.O.>ln.}V2..8.E.....%.s'xT....;.....{.{I.Yti.L&3...|....0...-..^..m..4d@(u^.r....z..{.._...h.K...B...Bv....../...i..j=M...8p.,$X....,...f1|..1.L. !...H5.lM......d.Ghr ...v.. .......D^.i..2.US..`...;............`t3!..\.8faI.;*..X..K5kP.X.Z<._...|[. ..au...K'.1..c...7.cqE..9/[.lp...L...W..1x.d.u.a.b.&.HmX.J..<....7y.LN.*D.uL.T ..7$"I .GMo.c...Yu0b.}6....wZ\..XTx.x~..:.\.......Fco...t:>*....w._.,3=.:.5..Ai....P.z..{8.~..D

                                                                                                                                                                                                                                  Chrome Cache Entry: 885

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 72 x 72, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):552
                                                                                                                                                                                                                                  Entropy (8bit):7.518958003484025
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:25EA82CB08DC5A62524703BED5E2350C
                                                                                                                                                                                                                                  SHA1:A2605B27BF1AA930AA07A13FB0C3308C5DD59870
                                                                                                                                                                                                                                  SHA-256:3BFDF9079467818150471AE73D381CC3D7C2FE4995955943AAF494575FDBEDB7
                                                                                                                                                                                                                                  SHA-512:E952351CF584DE2A02E9775538A18F0E729B0176D995B702752948DE1854EA08824C0F104AFBCF2D4E19B396753FBE7B31C73FC73B23157A3B87C00976B278C3
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/icon/box-epm-pro.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...H...H.......t...$PLTE...............K........s..-........../.....IDATH..=K.A......{.......m..l.[.O......Mb.Hu..........L.....Z...afgf.h._....<.......0L.c...m...b..p.Dn.H%.g..F*u..8,o....X.`.l..T..%..8#M.I..dj|e' ...H.Y...B....qo....ET....*..,M.mAB4#r.l.)tf...K5S.r.Ujs.].....H..7UA.v.U.jeU:..0k..$...:...*O.....a/...3..<.6bzE.th~.......t.d&...u......e...|*..j.H...,69/..?.AP...$$?m.....I..>.G....D.y.r..dB.g/H..5...t...#z|W...a.w..UA.W4;.!.N..w..F.5c.(!E.+....~.\xu..F..N9....?..x...........2k.X.Q.....IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 888

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2165)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):185203
                                                                                                                                                                                                                                  Entropy (8bit):5.52464319918498
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:23D76E5A68020C6795ED7B4AA22E4C7B
                                                                                                                                                                                                                                  SHA1:7A55091FAF70C1390EB26E46D52261D9715CA06B
                                                                                                                                                                                                                                  SHA-256:32851FF21B5ED5A6C29C95379A11933660403358A0A9409114C940088CA00FA1
                                                                                                                                                                                                                                  SHA-512:0DEDF7E170BCAB08E1F9955C7164FE8695EFBDF8764622D9F7408BDD3FD7AB193D6CC3DAAFE792522A1E74F303C9A989E7F9374E0B6119BD6872600AC9897A6C
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.googletagmanager.com/gtm.js?id=GTM-WC3GM72
                                                                                                                                                                                                                                  Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"68",. . "macros":[{"function":"__e"},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__f","vtp_component":"URL"},{"function":"__e"},{"function":"__v","vtp_name":"gtm.element","vtp_dataLayerVersion":1},{"function":"__v","vtp_name":"gtm.elementClasses","vtp_dataLayerVersion":1},{"function":"__v","vtp_name":"gtm.elementId","vtp_dataLayerVersion":1},{"function":"__v","vtp_name":"gtm.elementTarget","vtp_dataLayerVersion":1},{"function":"__v","vtp_name":"gtm.elementUrl","vtp_dataLayerVersion":1},{"function":"__aev","vtp_varType":"TEXT"},{"function":"__dbg"},{"function":"__cid"},{"

                                                                                                                                                                                                                                  Chrome Cache Entry: 889

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (37026)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):37105
                                                                                                                                                                                                                                  Entropy (8bit):5.211798964088098
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A6CF9BB482980C3C233776DB855F14D2
                                                                                                                                                                                                                                  SHA1:2192164FEC1D292D9FB1A01FE69B9CFA3029EB24
                                                                                                                                                                                                                                  SHA-256:E7F65FC4BF3EE8935F49DA454102685D3629BC341FF28FFB758A2951E0CCB71F
                                                                                                                                                                                                                                  SHA-512:166E027CA5B643499DFD4A048C8C8AFFDF3AE58A246E709161B5E63F0536DC1BDDEAC0DB63AE5550B06F14A1B5FF0703DF781B433FC6F2A67EBFDB0A1A39BA90
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/firebase-messaging-sw.js
                                                                                                                                                                                                                                  Preview:/*! For license information please see firebase-messaging-sw.js.LICENSE.txt */.(()=>{var e={676:function(e,t){!function(e){"use strict";function t(e){return Array.prototype.slice.call(e)}function n(e){return new Promise((function(t,n){e.onsuccess=function(){t(e.result)},e.onerror=function(){n(e.error)}}))}function i(e,t,i){var o,r=new Promise((function(r,a){n(o=e[t].apply(e,i)).then(r,a)}));return r.request=o,r}function o(e,t,n){var o=i(e,t,n);return o.then((function(e){if(e)return new l(e,o.request)}))}function r(e,t,n){n.forEach((function(n){Object.defineProperty(e.prototype,n,{get:function(){return this[t][n]},set:function(e){this[t][n]=e}})}))}function a(e,t,n,o){o.forEach((function(o){o in n.prototype&&(e.prototype[o]=function(){return i(this[t],o,arguments)})}))}function s(e,t,n,i){i.forEach((function(i){i in n.prototype&&(e.prototype[i]=function(){return this[t][i].apply(this[t],arguments)})}))}function c(e,t,n,i){i.forEach((function(i){i in n.prototype&&(e.prototype[i]=function

                                                                                                                                                                                                                                  Chrome Cache Entry: 893

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):182
                                                                                                                                                                                                                                  Entropy (8bit):6.7781573461356786
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:DFB0798C7F1BE59B594EC37D478AF61A
                                                                                                                                                                                                                                  SHA1:F2CBC6AE9AC0AA173FF8C79B1F56196DCE477AF9
                                                                                                                                                                                                                                  SHA-256:08D40BBFCE591C20C35228EB48D710389AF9CCBAF8D20F3FA792C32F53C6D191
                                                                                                                                                                                                                                  SHA-512:A6E87846F2D02D9016FE020C2E72F6595C4B16809F8E5E188032803493DCCF1686DBDE2556D1F384FE64D48079E47D1CB961D8B0D24AAAE81FC0E293153FCE52
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2019/livechat/2021/7-22/chat-gif-2.png
                                                                                                                                                                                                                                  Preview:RIFF....WEBPVP8L..../........$.?i.z............B...B.7...B.3(.!.......O.m.d.8....5..L.9.A..H.k4W..K.'S.;..d.V.._i..%..X2..V........L....8C.p4SJ&f.&..x.1J.......t[..........

                                                                                                                                                                                                                                  Chrome Cache Entry: 896

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):78
                                                                                                                                                                                                                                  Entropy (8bit):5.121376737843387
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2A00B2B564ED01A22C2E7D3A332CFA18
                                                                                                                                                                                                                                  SHA1:68F55C9BF81B26CBBB5DB6A487248FF0A87AEC58
                                                                                                                                                                                                                                  SHA-256:4F6182B8CB6E1916898D50D6FD47D0BB8225FEBA50553A9BE33D3F54FFEC32CB
                                                                                                                                                                                                                                  SHA-512:EECD9A76DDD3AB185EE9BC874AD5127E6AE0A2A8330A54A0466322D5067D0766976316DA44F27F855F829ED67E8D348F8FDBE40333E00E92CA0E80273744C8CA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:{"id":"151","status":"OK","userid":"k-Xz7RfH7SFkuR3iGMtOHNqjTloLKW3Bv4TxcAXg"}

                                                                                                                                                                                                                                  Chrome Cache Entry: 897

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 29 x 24, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):243
                                                                                                                                                                                                                                  Entropy (8bit):6.748330402031688
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:EDE4F5AAD51C4BC9F7F0FF173F0ACA30
                                                                                                                                                                                                                                  SHA1:AB3280C1F0864EB0CCF549018F22ADD006A923B6
                                                                                                                                                                                                                                  SHA-256:11B677114C3682C4BD0216818A5590C6040F6D3C6167FD4BB5EA6276CD020B19
                                                                                                                                                                                                                                  SHA-512:8B5C8B19F145D8FC87BFF48E2040FEC4A8642689DAF6320960F66806E43C90A550A4C68EA08A55947F7885ED13B0DB6800352924F79363BA1DE6A26AB0B4477E
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR..............W>7....IDATx...Mq.0..PA..C..CX..!....P..`...C0..'.g.3.}.i...m.>.Am.qeuW.N...A-..>....Z.}. .-..Q.C.U..a...h.%........]..0;.R..j....+...7H.}c.a.....s.Z.g{M.....#.z......I..x..(.*...).C..k....w.......IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 900

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (2763), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2763
                                                                                                                                                                                                                                  Entropy (8bit):5.857450857503642
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:E8CE28EF3D8203D7A593B0EFF177244E
                                                                                                                                                                                                                                  SHA1:4B13C9F3378FDE19D031F1F859CADE15507BF657
                                                                                                                                                                                                                                  SHA-256:C150221BF898DE34C98E5FCC2C74A22DCB9C4D742367D2321E92ECF39C102375
                                                                                                                                                                                                                                  SHA-512:944A01464F2753CB233FB86422FED39E6290C134FB85D66012E148ABCB86839F36AF79A49CA6EE1FAD9A01915F2AF98C94F2F4A2EAA1B270B29852D7D56CB292
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11113079898/?random=1713902809909&cv=11&fst=1713902809909&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v9105307171za200&gcd=13t3t3t3t5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&npa=0&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                                                                                                                                                                                                                  Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c||63==c)if(c=d.charCodeAt(b+3),!c||61==c||38==c||35==c)br

                                                                                                                                                                                                                                  Chrome Cache Entry: 901

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):103198
                                                                                                                                                                                                                                  Entropy (8bit):5.5401992240170195
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:6E7DE7C51B5D8AB355C34FD9E0831212
                                                                                                                                                                                                                                  SHA1:837914A237C23A2E44D0C3905FD0E63B60902B7E
                                                                                                                                                                                                                                  SHA-256:B609CA4236CE3308BEEBD36123A1C4E808758221202B1302567E5B290D484F49
                                                                                                                                                                                                                                  SHA-512:FE00FCAA6B12DA23E13A95CD040E8D1BFD44FC0BCEF0303ED0DB1BFC8048133E693861924F89788744683915E99968AB3DCB31097F2DF6972AA3E65498B9ABAA
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://td.doubleclick.net/td/rul/1064956115?random=1713902813610&cv=11&fst=1713902813610&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44h0h1v875306234za200&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.easeus.com%2Fbackup-software%2F&ref=https%3A%2F%2Fwww.easeus.com%2Fthankyou%2Finstall-data-recovery-wizard-free.htm%2F&hn=www.googleadservices.com&frm=0&tiba=EaseUS%20Todo%20Backup%20-%20EaseUS%20Data%20Backup%20Software%20for%20Windows%20PC%2FServer%2FMac&did=dMzk4MW&gdid=dMzk4MW&npa=0&userId=easeus-1713902766609-213268&us_privacy=1---&pscdl=noapi&auid=1511492506.1713902771&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dedownload%3Bevent_category%3Dtb_home_trial_win%3Bevent_label%3Dproduct_banner
                                                                                                                                                                                                                                  Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j689129974"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j691334967"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j797471435"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j797761798"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7572346854"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j7589463467"}},{"action":1,"interestGroupAttributes":{"owner":"https

                                                                                                                                                                                                                                  Chrome Cache Entry: 902

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with very long lines (37540), with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):37546
                                                                                                                                                                                                                                  Entropy (8bit):5.220053829148576
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2ABB86E1F7F4C627EEFE8788D6E933AB
                                                                                                                                                                                                                                  SHA1:6B4E02D07469B99E56F1C3A92C4C5F1411A3C87B
                                                                                                                                                                                                                                  SHA-256:9C9D4C4F59F4B8F9CDE8FC40F07AA9B75C25F15D212C13654A00419AF2ED1012
                                                                                                                                                                                                                                  SHA-512:DEFE8F70DB58B7E5D3E21083D695BF4C06C3BFA8D49F2CF8EB566C022AAB42FF59F678114BE07B8F113118425D84C8F11932CC88C8228B86A7A65AAECC9520DB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/webpack/dist/firebase.js
                                                                                                                                                                                                                                  Preview:/*!For license information please see firebase.js.LICENSE.txt*/(()=>{var e={676:function(e,t){!function(e){"use strict";function t(e){return Array.prototype.slice.call(e)}function n(e){return new Promise((function(t,n){e.onsuccess=function(){t(e.result)},e.onerror=function(){n(e.error)}}))}function i(e,t,i){var o,r=new Promise((function(r,a){n(o=e[t].apply(e,i)).then(r,a)}));return r.request=o,r}function o(e,t,n){var o=i(e,t,n);return o.then((function(e){if(e)return new l(e,o.request)}))}function r(e,t,n){n.forEach((function(n){Object.defineProperty(e.prototype,n,{get:function(){return this[t][n]},set:function(e){this[t][n]=e}})}))}function a(e,t,n,o){o.forEach((function(o){o in n.prototype&&(e.prototype[o]=function(){return i(this[t],o,arguments)})}))}function s(e,t,n,i){i.forEach((function(i){i in n.prototype&&(e.prototype[i]=function(){return this[t][i].apply(this[t],arguments)})}))}function c(e,t,n,i){i.forEach((function(i){i in n.prototype&&(e.prototype[i]=function(){return o(this

                                                                                                                                                                                                                                  Chrome Cache Entry: 906

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:Web Open Font Format (Version 2), TrueType, length 29596, version 1.0
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):29596
                                                                                                                                                                                                                                  Entropy (8bit):7.992452643290949
                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:66086CBC5718A7387DA856ABD30EAE96
                                                                                                                                                                                                                                  SHA1:DB6B29A1B1094969B8095848983E9844879BBDF8
                                                                                                                                                                                                                                  SHA-256:F5DCCC4EFD8D7D00BFE81F0C4BF16FD883D83F6872A60F68E55409E3F1DC1E88
                                                                                                                                                                                                                                  SHA-512:C15BA8D5BA8D9BBB516F79D6A7095622B44785EBB8B218223CB9AD8E0AB618D88294EB6A5405BD42D5A5D5651F07FBEA56D9BF971A9EEB1983E84E381D641E06
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/default/typeface/Lexend/Lexend-SemiBold.woff2
                                                                                                                                                                                                                                  Preview:wOF2......s.......5...s9..........................,...p..x.`?STAT*........t..\.....6.$..4. .....k..[..q.....c.^U....6}.Q.v=..Fc.q3.md .8...........L.\..jA7..?.-...$..7..L.`Y..R..F.H.5.9..F`.QL..M.....J...E...f.Yk.z.N4ta..<_...'.2...610.]...}....*..rW.N....L..0F....0@...][C.X.Z..u..-].}I.....&.O.<.x.G...m>S...B.Ce...R...Q....W3.... ...2..~..Ie..\J.eH..@../...!e....6..{.<..4.mBD..E.s.._....v..5......1.w:.1<?......m.X.U.H6`.E.$zDI..JI.."6f.Y'...ug.^.^..?....w.......?..<8......Ws..l.f.uv.I2.k.('..ay.Z...M.<.....rh.5....M\.tQ.S.H..d.2.7....|.....I.r.k)........#{.......~s.}...I.Kb..Xft.P.x.D....w....>...../b.C5z.K.q..>.2..iAfA...2..Q..3cf\..."....Qgb.^j.21*F..s..Z.K..|.?.\.vW.Je.H..1.O....y..J....zU.....I.1'n......D...5m.mrBO..v.....y...........en\C)....n.s...h...d.._.A....Z#..}NvRQ..tI%...;7...r.er...x...|.n.G.F\[...L+...'f....a7..k.....f.}...3].M.5]".l.1........~...l.... ..C.&Sp.,.....:.$W..Y$E.......q..j>!%]..m...e...y.....6...*...xV.,.d..2.

                                                                                                                                                                                                                                  Chrome Cache Entry: 908

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):1248
                                                                                                                                                                                                                                  Entropy (8bit):7.8121450972996485
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:2F6826607903CD14AB2BB279CB52BE4D
                                                                                                                                                                                                                                  SHA1:DBBB8116368ECF5E24153AAE95CBC0D2C3DFF959
                                                                                                                                                                                                                                  SHA-256:265066D0BE9A304284709BE0279BDE49A44E49DD41833C46B70CB99C8F1C8EBA
                                                                                                                                                                                                                                  SHA-512:3C1AF5C399EA3CE25FC05F13A55BD9E2C36325E6BE5FABA92D2208A18EFB9EFD2C100D3B4938AF3FFF5695B3B5979620DDA42636952287E8A9A525797663FBAB
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/newsletter/2020-2/30-days-money-back.png
                                                                                                                                                                                                                                  Preview:RIFF....WEBPVP8L..../+...7.(.$E=........m.9.....X.2.$).....?z.m59I...0u..;...@Mt..p.1#.H.B8..Ix#.'.`.L.#.m...~...........`.F.^.....3.........Z..?)0`.....-.8RO..$.%..~Q...od.J....wN..I.E"w....,B.....F.+E......o..%..Q...[]g....D.I..h...j...(j......,..I..R.)..#....?.6...7.........'.^.^._.......o........x.u..K...~L$.y........$.1...t..#d#`|..V.R.bo.....g..y....W?.....R..4'Q..R...vVp.3w.R....xBw.L...5R...Tm.~...5. .'.TOV#c..3G.U.*..)..~..q.W..nyI6.....v....Yo..a.2.'..xz<O.U.....C.T.`u.%.x....&.$......VU.5..fwi..2N.L./.e!.B.r..`8q...h6....5.?$..<I..+.P&......0Yv.8{K...D..bQ......z.t..g.O....K...s.j...M....Azy........@A.......s.a...0.-D..3.~T.wY....[w8.B".]D..*r;B,d... ..@...,u..!...E.........A..~+4.....sGV.W.HX.....^.BY....<\.x.....0]..p$}m...Uh..p!K...^...P.......5Q..dH.. >..3...(B....j..W2`n...]...leR..J.)e+7..iw...s...8_..wW.8..$h.......b}yZ.X.\.x..=.1.PD.2).rx".`}8~.{.^..l...-...*L..t.`.N<....w.n.....+..J K%.@.0.....<...0c.....+.@kj]...(...X..7

                                                                                                                                                                                                                                  Chrome Cache Entry: 909

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 275x210, components 3
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):16935
                                                                                                                                                                                                                                  Entropy (8bit):7.965842549799353
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:B2B9CA8D6AAD638F8022E285018A3ADB
                                                                                                                                                                                                                                  SHA1:A30C4194E05471285BC92C4C5FA10A6337C2EF50
                                                                                                                                                                                                                                  SHA-256:67901629D5857794A4F68B5C35B78D4916A06339C7B6198B605A7F241C222DF6
                                                                                                                                                                                                                                  SHA-512:50C286DA816A0A959D3763FF41CCA15E53F54D6274963BCD31B1E3DA09C46B7CD19494B3B5D699ED0B11B0F589628AF6BFD9EA34FB22518EE9A8CE7992E8CBB9
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}...........".....................................................Z..V.L.4......K...7..Go.+._|...NIW>_X.;...b.^.G.IO..t..;.....8..b.u....~......z.0.......y..".Y.....Y..n....Q.GP.../>..9!..U../.;.G...<.}.....;.....K..o).]#..Xp.[l.I.......l..o:c{r....Z>....:w.....<&......d.CB...Ky..HG.,....M.~.By.F... .y@D.4...rJ.-~VJn.6.k,N.......3.k/.b._....#........|.O..S..b....sY\.:..*.#.k.y..{.g.J.....1...>I.3./..-.z.c.x.lY\[0"9.J........aV.z]..{w9...z}.AP..O...}.\.M._^25q,..f.m.......u7...U..T.Y..N...].......5=....r`GK.Y#.}*.%Nj{..F.....B-..;......w.k8o)..7P...U...K.....!.=..l .0.....Mt..|..v...Ve..0..p.^..L..Q....*..F.N.4^.....s....$.......'.S.._!.m...r}...1......A..:.n4...z.O`...-.w.=GG..7e...J.L.w...Lx......\.._fb.....}....[P~.E....{.....Y......n.Idi..s.\@.}...x$U..\.z.;cf....c'b.r...S..}LV.3.

                                                                                                                                                                                                                                  Chrome Cache Entry: 912

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 241 x 939, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):2196
                                                                                                                                                                                                                                  Entropy (8bit):7.612798341708711
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:25D385DA770892E94D0B8C4FD3ECA71B
                                                                                                                                                                                                                                  SHA1:D1138C6929E9875F1688CA6E4678AA80C1249A48
                                                                                                                                                                                                                                  SHA-256:A7B50F5BA21210DDBE16642E800A986EB4F6C94B9773A47840ABA64F2831FDBB
                                                                                                                                                                                                                                  SHA-512:D6833C83569B70BC5AE8F7B486DC0A518404A9408380BB9A53D1090571C9D7FD9366414B6D342A236A243556EF430E57DBA09A2CBF6F409EC88AB933375CC9FF
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/images_2016/icon-index.png
                                                                                                                                                                                                                                  Preview:.PNG........IHDR...............7...HPLTE............m.........///........m..m..UUUYYY...........]]]......(p.........tRNS.&@........'.k.o..V..2.....IDATx....0....Ow.h}...wq4[iS...~....~K.n.a.C...wt.,.....n..@..+.<.'..... ....2f.K\C..*+...K..0E.Sn..x+3..g.1...:.....+..K...`.](.%c|.3.,V..u3.\.C.GMU......ibl[...3.....B`Qe.fU.....s.....S.....O...)c.-c%b..V.z..99.....[..^..<..gj\..AK....G.+G...*.F ,..O..`.&5Q..r......W..:.a......>..DC4..-.0.yR....d............@:VFk..k.\.:=.k,..u#.....e..........1...uPQ..k...pZg.>.fyj..I.>A=...)....AA5.../..-...b.X,...b.X.........@..........*..;..0.@A.....o.......f......~Wk........a.1..Tr\...q.)..8..qL...T|.F.<9...........iwp..R..fK+.....................v...%...a..?e......?.E......?...|..`._.............^...b...................}8..-U..q._.%.......7.}....b....b....b...x..7^..Y..x..g1p.:..b.F=.......x..7z..Y...2.g1p.......I.x..7f'.Y....g1pc>.....D.x..72..Y..H}.w1pB.....b.].....b...x..'....8!.....1...N..w1pB.....b.].....b.

                                                                                                                                                                                                                                  Chrome Cache Entry: 913

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:PNG image data, 168 x 168, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                  Size (bytes):860
                                                                                                                                                                                                                                  Entropy (8bit):7.6392673087226886
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:88479BE29AF5E95CD15563AAB3EC8F40
                                                                                                                                                                                                                                  SHA1:83D6A2986536E8C849E8DC31E218C2B79771AFD4
                                                                                                                                                                                                                                  SHA-256:CA5E62715947BD5B08110B3A8745019D6BFA4E4EBFF13257EDBBD71E6104788D
                                                                                                                                                                                                                                  SHA-512:71CC2C0E0FF6E219E30BA83BD9CA45BB1F774951ABFA0958B2A25C476BC93EC0F211987B2A8670287EDCB993E73E01B5B530A24BE924E78875EB0EB8551F425A
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  Preview:.PNG........IHDR..............e......PLTE...........................R,#m....tRNS.t.3.U..*.......IDATh...O"Q...o..RNv.J...w...d|.#>.TQ...X:.......{.....+h......1....b..bk.t......q..]....w...w..~a..WA....Fi......G........Ut5.U.........6..9.9.0R..).L..9D..).T.1l}.`)X......s.+A...VU.....;..Pf[.C8Z.7V#..7...^.gA.....O.OI...Z....-.(%<Y...J....R.D..5JS..R-x.i.IRx..Q$...../.e..O...1.GU..)...oW.03..R.o..|...U...6.0.CP...(......PM.B5s.E^..Hz.JS..$.X.0A3.m)sS.&h*.<.4..8'...?..4.N..Q"m.i.../...O@u&O..|..I.<.rN.'E.>.......-2.[..T.1....k*.u...\U..{...O@6...C....6.....Y.+.K.vl. ..`.s.[fp..roK........y*.%..y......V....qB.>rD.1Ad..hDJ..K..$..S...K.H2...... ......El9b ......>&F...uxp....2 :.!...@p."N..N......D....x..1.2B.....`..M.."......'`A.5......j..-....,.k..{.....W.iQ<...c...H..S..-..U......2.a)...'..^.D.....IEND.B`.

                                                                                                                                                                                                                                  Chrome Cache Entry: 914

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with very long lines (2244), with CRLF line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):4613
                                                                                                                                                                                                                                  Entropy (8bit):5.707739183953767
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:A0A0A0735B9694429F706A48E386CE83
                                                                                                                                                                                                                                  SHA1:42DC994C055C84169AE0532A5B51A0B97FA571DA
                                                                                                                                                                                                                                  SHA-256:91BC9B0977A18AEC61C095D3EF2DA959765677916808BCF301B6B73D193592A0
                                                                                                                                                                                                                                  SHA-512:56B6CCF9060800B9CE970D59289E1EAF9B07D7D0E04E087C9575E53227C224AD152B3649754BE2B58F4E3BDC906A749B8DBD4BD2B6F7852BC63B539AC089F7BD
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://fledge.us.criteo.com/interest-group?data=4jp3gXxENE1RVlpMWi96OEV5YzB4V2VPV3lNVUJMWWllU0FadWZORzZjdjkwUjZubk1GQmgyN1AzUUs0eDRZc0FrL1JjSjJnQVFNMllpcGx1Q3lsQzhGZzlBaWlCMDFoTDZnRzBYcnN1UGNPYU9xMk5MV1JPUzBLMGVPbFU0MFJEdlEwRlkzMXhFREFEMXpjaGwyVlBONGsweldCWkJ4cU56bjRqT1dkZllUajNFNmcwUFVxRzlCR01qcXl5bG1OL2hCdkZ3LzBubjE4SGFibDFZYmlSNjk2WEZnPT18
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>..<html lang="en">..<head>.. Chrome origin trial token -->.. <meta http-equiv="origin-trial" content="AnolOEEMEnMaCvmUcw/eijaA/Ntx4pke43TW8O1+XFxTL7yMSzmBnkPrjQ33sKmqvREEpLQOE72gUMzHLu9KiAoAAABseyJvcmlnaW4iOiJodHRwczovL2NyaXRlby5jb206NDQzIiwiZmVhdHVyZSI6IlByaXZhY3lTYW5kYm94QWRzQVBJcyIsImV4cGlyeSI6MTY5NTE2Nzk5OSwiaXNTdWJkb21haW4iOnRydWV9" >..</head>..<body>....<script>.. function getBswIg() {.. const elt = document.createElement("iframe");.. elt.allow = "join-ad-interest-group";.. elt.width = "0";.. elt.height = "0";.. elt.style.display = "none";.. elt.title = "BSW IG";.. elt.src = "https://dsp-paapi-sandbox.bsw-ig.criteo.com/paapi/dsp/html/index";.... document.body.appendChild(elt);.. }.... if (!navigator.joinAdInterestGroup) {.. console.log("No fledge for you!");.. } else {.. var igs = [{"owner":"https://fledge.us.criteo.com","name":"RJXR2XxzbG5XOU1VZVZxSmlSRXJ2VW5LaFhBPT18","li

                                                                                                                                                                                                                                  Chrome Cache Entry: 917

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):13
                                                                                                                                                                                                                                  Entropy (8bit):2.7773627950641693
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                                                                                                                                                                                                                  SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                                                                                                                                                                                                                  SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                                                                                                                                                                                                                  SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://td.doubleclick.net/td/ga/rul?tid=G-9ETQKR539E&gacid=2049280290.1713902770&gtm=45je44h0v888578332za200&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1598135840
                                                                                                                                                                                                                                  Preview:<html></html>

                                                                                                                                                                                                                                  Chrome Cache Entry: 918

                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  File Type:HTML document, Unicode text, UTF-8 text, with very long lines (701)
                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                  Size (bytes):46446
                                                                                                                                                                                                                                  Entropy (8bit):5.0804647034062596
                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                  SSDEEP:
                                                                                                                                                                                                                                  MD5:7585F921BCCF906E7B41BBDC7688832E
                                                                                                                                                                                                                                  SHA1:6E7B2625C0234A4FA85AD9D1BF9DA8C3370B6326
                                                                                                                                                                                                                                  SHA-256:724876B1D66BE3471E2E3A56DEDE352FA1867C9A8E5FC10B410D8D160CDFF058
                                                                                                                                                                                                                                  SHA-512:1AA238709EA244FBFBD28A0B94B13D7B9EFFFC1E0F3C7F135923D3139E0B3EDDD9307372AC244FBFB2DF8B77120AC5CC7627B683E183B817A0EF80DF6A3536BE
                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                  Reputation:unknown
                                                                                                                                                                                                                                  URL:https://www.easeus.com/thankyou/install-data-recovery-wizard-free.htm/
                                                                                                                                                                                                                                  Preview:<!DOCTYPE html>.<html lang="en">.<head>.<meta content="initial-scale=1.0,user-scalable=no,maximum-scale=1,width=device-width" name="viewport" />.<meta content="telephone=no" name="format-detection" />.<meta content="black" name="apple-mobile-web-app-status-bar-style" />.<meta content="yes" name="apple-mobile-web-app-capable" />.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>File not found</title>.<meta name="description" content="EaseUS offers Data Recovery Software, backup software, partition manager." />.<meta name="keywords" content="Easeus, data recovery, iphone recovery, bakcup software, partition manager" />.<link type="text/css" rel="stylesheet" href="/default2/css/base.css?version2" />.<link type="text/css" rel="stylesheet" href="/default/css/index.css" />.<script type="text/javascript" language="javascript" src="/default/js/jquery.js" data-cfasync="false"></script>.<script type="0822e98ce5f4cfadfe37300c-text/javascript" language="javascript" src="

                                                                                                                                                                                                                                  Static File Info

                                                                                                                                                                                                                                  ⊘No static file info