93dfa5d20ec19ccb31115a9f9464ccab26c7e9d870eeadaa149cc5aa691f1bed

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2023, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
Size

122KB
MD5

6aa4cab201084532ac8a143c1eb38e00
SHA1

64b09bffa91436862e916c438f668a4f0a43e344
SHA256

93dfa5d20ec19ccb31115a9f9464ccab26c7e9d870eeadaa149cc5aa691f1bed
SHA512

0a2d0ca30f1a1c0813434461f9d7fc552b2700b89b9924b8b48f5739b22e7cab8415affb702595f8d669ddba832b04559711983ad01b3c1ccd6303136402eb09
SSDEEP

1536:lvm1Fu8AjYaFwjRUdW7fmyY7aZYJVmy0KQbj6vbjuKoauGi4s:6u8ANCUdgfmD7zey0KUj6TjR9i4s

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Malware Backdoor - Berbew 64 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral2/memory/2112-0-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022e47-6.dat	family_berbew
behavioral2/files/0x0006000000022e4c-12.dat	family_berbew
behavioral2/files/0x0006000000022e4c-14.dat	family_berbew
behavioral2/files/0x0007000000022e4d-20.dat	family_berbew
behavioral2/files/0x0007000000022e4d-21.dat	family_berbew
behavioral2/memory/6048-18-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e4f-27.dat	family_berbew
behavioral2/files/0x0006000000022e4f-26.dat	family_berbew
behavioral2/files/0x0007000000022e50-34.dat	family_berbew
behavioral2/files/0x0006000000022e51-40.dat	family_berbew
behavioral2/files/0x0007000000022e52-46.dat	family_berbew
behavioral2/files/0x0007000000022e52-47.dat	family_berbew
behavioral2/files/0x0007000000022e53-54.dat	family_berbew
behavioral2/memory/5324-55-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022e54-62.dat	family_berbew
behavioral2/files/0x0007000000022e54-61.dat	family_berbew
behavioral2/files/0x0006000000022e56-69.dat	family_berbew
behavioral2/memory/4388-76-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022e57-86.dat	family_berbew
behavioral2/files/0x0006000000022e5a-91.dat	family_berbew
behavioral2/memory/5160-92-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e5a-93.dat	family_berbew
behavioral2/files/0x0007000000022e5b-101.dat	family_berbew
behavioral2/files/0x0007000000022e5b-102.dat	family_berbew
behavioral2/files/0x0007000000022e5d-129.dat	family_berbew
behavioral2/files/0x0007000000022e5d-128.dat	family_berbew
behavioral2/files/0x0006000000022e5f-135.dat	family_berbew
behavioral2/memory/2952-138-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022e5e-143.dat	family_berbew
behavioral2/memory/1908-142-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022e5e-141.dat	family_berbew
behavioral2/files/0x0006000000022e5f-134.dat	family_berbew
behavioral2/files/0x0007000000022e5c-109.dat	family_berbew
behavioral2/files/0x0007000000022e5c-108.dat	family_berbew
behavioral2/memory/2312-107-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/memory/3492-110-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/memory/3080-99-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022e57-85.dat	family_berbew
behavioral2/memory/2784-82-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/memory/2708-80-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/memory/64-79-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e58-75.dat	family_berbew
behavioral2/files/0x0006000000022e58-74.dat	family_berbew
behavioral2/memory/2112-68-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e56-67.dat	family_berbew
behavioral2/memory/5324-59-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022e53-53.dat	family_berbew
behavioral2/memory/5456-51-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/memory/2956-44-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e51-39.dat	family_berbew
behavioral2/files/0x0007000000022e50-33.dat	family_berbew
behavioral2/memory/1676-31-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e4c-13.dat	family_berbew
behavioral2/memory/4388-8-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022e47-7.dat	family_berbew
behavioral2/memory/3492-157-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/memory/4700-161-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/memory/3068-165-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x000e000000022d67-164.dat	family_berbew
behavioral2/files/0x0006000000022e64-171.dat	family_berbew
behavioral2/memory/3948-175-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew
behavioral2/files/0x000e000000022d66-177.dat	family_berbew
behavioral2/memory/632-185-0x0000000000400000-0x0000000000424000-memory.dmp	family_berbew

C:\Users\Admin\AppData\Local\Temp\NEAS.6aa4cab201084532ac8a143c1eb38e00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6aa4cab201084532ac8a143c1eb38e00.exe"
1⤵
PID:2112
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:5324
- C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
  C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  PID:5456
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  PID:3492
- - C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe
    "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\
    3⤵
    PID:2156
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  PID:1676
- C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
  2⤵
  PID:5160
- C:\Users\Admin\AppData\Local\Temp\282813517\backup.exe
  C:\Users\Admin\AppData\Local\Temp\282813517\backup.exe C:\Users\Admin\AppData\Local\Temp\282813517\
  2⤵
  PID:6048
- C:\Users\Admin\AppData\Local\Temp\{62E26D9F-BAEE-4D69-BE8F-82A5AD67D75E}\backup.exe
  C:\Users\Admin\AppData\Local\Temp\{62E26D9F-BAEE-4D69-BE8F-82A5AD67D75E}\backup.exe C:\Users\Admin\AppData\Local\Temp\{62E26D9F-BAEE-4D69-BE8F-82A5AD67D75E}\
  2⤵
  PID:4388

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\data.exe
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\data.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\
1⤵
PID:64

C:\backup.exe
\backup.exe \
1⤵
PID:3068
- C:\Program Files\backup.exe
  "C:\Program Files\backup.exe" C:\Program Files\
  2⤵
  PID:632
- - C:\Program Files\Google\backup.exe
    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
    3⤵
    PID:5796
- - C:\Program Files\Internet Explorer\backup.exe
    "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
    3⤵
    PID:2464
  - - C:\Program Files\Internet Explorer\de-DE\backup.exe
      "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
      4⤵
      PID:6092
    - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
        5⤵
        
        PID:1692
    - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
        5⤵
        
        PID:1068
  - - C:\Program Files\Internet Explorer\images\data.exe
      "C:\Program Files\Internet Explorer\images\data.exe" C:\Program Files\Internet Explorer\images\
      4⤵
      PID:5084
  - - C:\Program Files\Internet Explorer\it-IT\backup.exe
      "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
      4⤵
      PID:1404
  - - C:\Program Files\Microsoft Office\Office16\backup.exe
      "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
      4⤵
      PID:1860
  - - C:\Program Files\Microsoft Office\PackageManifests\backup.exe
      "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
      4⤵
      PID:1924
  - - C:\Program Files\Microsoft Office\root\backup.exe
      "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
      4⤵
      PID:648
    - - C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
        5⤵
        
        PID:4492
      - C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
        6⤵
        
        PID:5316
        
        C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\
        7⤵
        
        PID:4832
        
        C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
        8⤵
        
        PID:5020
      - C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
        6⤵
        
        PID:2776
      - C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
        6⤵
        
        PID:6052
    - - C:\Program Files\Microsoft Office\root\fre\backup.exe
        
        "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
        5⤵
        
        PID:3344
    - - C:\Program Files\Microsoft Office\root\Integration\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\
        5⤵
        
        PID:6120
      - C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
        6⤵
        
        PID:812
    - - C:\Program Files\Microsoft Office\root\Licenses16\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\
        5⤵
        
        PID:3200
    - - C:\Program Files\Microsoft Office\root\loc\backup.exe
        
        "C:\Program Files\Microsoft Office\root\loc\backup.exe" C:\Program Files\Microsoft Office\root\loc\
        5⤵
        
        PID:1240
    - - C:\Program Files\Microsoft Office\root\Office16\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\
        5⤵
        
        PID:3712
      - C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\
        6⤵
        
        PID:3464
        
        C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\
        7⤵
        
        PID:2608
        
        C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\
        7⤵
        
        PID:5020
        
        C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\
        7⤵
        
        PID:4552
        
        C:\Program Files (x86)\Windows NT\TableTextService\backup.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\
        8⤵
        
        PID:2904
      - C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\
        6⤵
        
        PID:4428
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\
        7⤵
        
        PID:2908
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\
        7⤵
        
        PID:5184
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\
        8⤵
        
        PID:5328
        
        C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\
        9⤵
        
        PID:5296
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\data.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\data.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\
        7⤵
        
        PID:2784
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\
        7⤵
        
        PID:4444
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\
        7⤵
        
        PID:3680
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\
        8⤵
        
        PID:4704
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\
        8⤵
        
        PID:1580
        
        C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\System Restore.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\
        8⤵
        
        PID:2464
      - C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe" C:\Program Files\Microsoft Office\root\Office16\AugLoop\
        6⤵
        
        PID:4688
      - C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\BORDERS\
        6⤵
        
        PID:5268
      - C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\
        6⤵
        
        PID:5672
      - C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe" C:\Program Files\Microsoft Office\root\Office16\3082\
        6⤵
        
        PID:6072
      - C:\Program Files\Microsoft Office\root\Office16\1036\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\1036\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1036\
        6⤵
        
        PID:3956
      - C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\Configuration\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Configuration\
        6⤵
        
        PID:2512
      - C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\
        6⤵
        
        PID:5976
        
        C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\
        7⤵
        
        PID:1904
        
        C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\
        8⤵
        
        PID:932
        
        C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\
        9⤵
        
        PID:5364
        
        C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\
        9⤵
        
        PID:4728
      - C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f14\
        6⤵
        
        PID:1000
      - C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f2\
        6⤵
        
        PID:5464
      - C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\FPA_f3\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f3\
        6⤵
        
        PID:396
      - C:\Program Files\Microsoft Office\root\Office16\FPA_f33\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\FPA_f33\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f33\
        6⤵
        
        PID:2872
      - C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\
        6⤵
        
        PID:2448
      - C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\
        6⤵
        
        PID:5288
      - C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\backup.exe" C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\
        6⤵
        
        PID:1328
      - C:\Program Files\Microsoft Office\root\Office16\Library\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\Library\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\
        6⤵
        
        PID:5128
    - - C:\Program Files\Microsoft Office\root\Templates\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Templates\backup.exe" C:\Program Files\Microsoft Office\root\Templates\
        5⤵
        
        PID:2968
      - C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\
        6⤵
        
        PID:2376
        
        C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\
        7⤵
        
        PID:2108
        
        C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\
        7⤵
        
        PID:32
        
        C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\
        8⤵
        
        PID:1728
        
        C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\
        9⤵
        
        PID:3932
      - C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe" C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\
        6⤵
        
        PID:5344
    - - C:\Program Files\Microsoft Office\root\vfs\update.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\update.exe" C:\Program Files\Microsoft Office\root\vfs\
        5⤵
        
        PID:5068
      - C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\
        6⤵
        
        PID:5700
        
        C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\Fonts\private\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\private\
        7⤵
        
        PID:1220
      - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\
        6⤵
        
        PID:5608
      - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\
        6⤵
        
        PID:5316
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\update.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\
        7⤵
        
        PID:744
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\
        8⤵
        
        PID:4184
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\
        9⤵
        
        PID:1624
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\
        8⤵
        
        PID:3756
      - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\data.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\
        6⤵
        
        PID:5984
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\
        7⤵
        
        PID:5428
    - - C:\Program Files\Microsoft Office\root\rsod\backup.exe
        
        "C:\Program Files\Microsoft Office\root\rsod\backup.exe" C:\Program Files\Microsoft Office\root\rsod\
        5⤵
        
        PID:5244
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
        6⤵
        
        PID:3396
    - - C:\Program Files\Microsoft Office\root\Office15\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office15\backup.exe" C:\Program Files\Microsoft Office\root\Office15\
        5⤵
        
        PID:3136
    - - C:\Program Files\Microsoft Office\root\Licenses\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\
        5⤵
        
        PID:3760
    - - C:\Program Files\Microsoft Office\root\Client\System Restore.exe
        
        "C:\Program Files\Microsoft Office\root\Client\System Restore.exe" C:\Program Files\Microsoft Office\root\Client\
        5⤵
        
        PID:6100
    - - C:\Program Files\Microsoft Office\root\vreg\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vreg\backup.exe" C:\Program Files\Microsoft Office\root\vreg\
        5⤵
        
        PID:2076
- - C:\Program Files\Java\data.exe
    "C:\Program Files\Java\data.exe" C:\Program Files\Java\
    3⤵
    PID:1156
  - - C:\Program Files\Java\jdk-1.8\backup.exe
      "C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\
      4⤵
      PID:3284
    - - C:\Program Files\Java\jdk-1.8\bin\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\
        5⤵
        
        PID:4568
    - - C:\Program Files\Java\jdk-1.8\include\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\include\backup.exe" C:\Program Files\Java\jdk-1.8\include\
        5⤵
        
        PID:4416
    - - C:\Program Files\Java\jdk-1.8\lib\update.exe
        
        "C:\Program Files\Java\jdk-1.8\lib\update.exe" C:\Program Files\Java\jdk-1.8\lib\
        5⤵
        
        PID:3860
  - - C:\Program Files\Java\jre-1.8\System Restore.exe
      "C:\Program Files\Java\jre-1.8\System Restore.exe" C:\Program Files\Java\jre-1.8\
      4⤵
      PID:4828
    - - C:\Program Files\Java\jre-1.8\legal\backup.exe
        
        "C:\Program Files\Java\jre-1.8\legal\backup.exe" C:\Program Files\Java\jre-1.8\legal\
        5⤵
        
        PID:1356
      - C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe
        
        "C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jre-1.8\legal\jdk\
        6⤵
        
        PID:2308
      - C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe
        
        "C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jre-1.8\legal\javafx\
        6⤵
        
        PID:392
      - C:\Users\Admin\Videos\backup.exe
        
        C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
        6⤵
        
        PID:3088
    - - C:\Program Files\Java\jre-1.8\lib\System Restore.exe
        
        "C:\Program Files\Java\jre-1.8\lib\System Restore.exe" C:\Program Files\Java\jre-1.8\lib\
        5⤵
        
        PID:2396
      - C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe" C:\Program Files\Java\jre-1.8\lib\amd64\
        6⤵
        
        PID:4336
      - C:\Program Files\Java\jre-1.8\lib\applet\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\applet\backup.exe" C:\Program Files\Java\jre-1.8\lib\applet\
        6⤵
        
        PID:5296
      - C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe" C:\Program Files\Java\jre-1.8\lib\cmm\
        6⤵
        
        PID:4164
      - C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe" C:\Program Files\Java\jre-1.8\lib\deploy\
        6⤵
        
        PID:4272
      - C:\Program Files\Java\jre-1.8\lib\ext\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\ext\backup.exe" C:\Program Files\Java\jre-1.8\lib\ext\
        6⤵
        
        PID:5992
      - C:\Program Files\Java\jre-1.8\lib\images\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\images\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\
        6⤵
        
        PID:5116
        
        C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\images\cursors\backup.exe" C:\Program Files\Java\jre-1.8\lib\images\cursors\
        7⤵
        
        PID:4264
      - C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe" C:\Program Files\Java\jre-1.8\lib\jfr\
        6⤵
        
        PID:4516
      - C:\Program Files\Java\jre-1.8\lib\management\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\management\backup.exe" C:\Program Files\Java\jre-1.8\lib\management\
        6⤵
        
        PID:4884
      - C:\Program Files\Java\jre-1.8\lib\security\update.exe
        
        "C:\Program Files\Java\jre-1.8\lib\security\update.exe" C:\Program Files\Java\jre-1.8\lib\security\
        6⤵
        
        PID:5728
        
        C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\security\policy\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\
        7⤵
        
        PID:2260
        
        C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\limited\
        8⤵
        
        PID:1936
        
        C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\
        8⤵
        
        PID:1060
      - C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe" C:\Program Files\Java\jre-1.8\lib\fonts\
        6⤵
        
        PID:2708
    - - C:\Program Files\Java\jre-1.8\bin\backup.exe
        
        "C:\Program Files\Java\jre-1.8\bin\backup.exe" C:\Program Files\Java\jre-1.8\bin\
        5⤵
        
        PID:5320
- - C:\Program Files\Microsoft Office 15\backup.exe
    "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
    3⤵
    PID:2636
- - C:\Program Files\Mozilla Firefox\backup.exe
    "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
    3⤵
    PID:4432
  - - C:\Program Files\Mozilla Firefox\defaults\backup.exe
      "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
      4⤵
      PID:3036
    - - C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
        
        "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
        5⤵
        
        PID:3864
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\
        6⤵
        
        PID:1236
  - - C:\Program Files\Mozilla Firefox\fonts\backup.exe
      "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
      4⤵
      PID:1412
  - - C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
      "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
      4⤵
      PID:812
    - - C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
        
        "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
        5⤵
        
        PID:1740
  - - C:\Program Files\Mozilla Firefox\uninstall\data.exe
      "C:\Program Files\Mozilla Firefox\uninstall\data.exe" C:\Program Files\Mozilla Firefox\uninstall\
      4⤵
      PID:2220
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.177.11\backup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.177.11\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.177.11\
      4⤵
      PID:1112
    - - C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe
        
        "C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
        5⤵
        
        PID:5828
- - C:\Program Files\Reference Assemblies\backup.exe
    "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
    3⤵
    PID:5528
  - - C:\Program Files\Reference Assemblies\Microsoft\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
      4⤵
      PID:4476
    - - C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
        5⤵
        
        PID:3884
      - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
        6⤵
        
        PID:1000
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
        7⤵
        
        PID:2440
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
        7⤵
        
        PID:2340
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\
        8⤵
        
        PID:5280
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\
        9⤵
        
        PID:4632
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
        10⤵
        
        PID:2124
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\
        10⤵
        
        PID:5256
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\data.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\data.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\
        10⤵
        
        PID:4968
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\
        9⤵
        
        PID:3756
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\
        10⤵
        
        PID:5480
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\
        10⤵
        
        PID:2132
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\data.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\
        10⤵
        
        PID:1132
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\
        10⤵
        
        PID:2776
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
        7⤵
        
        PID:5376
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
        7⤵
        
        PID:2264
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
        7⤵
        
        PID:1400
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
        7⤵
        
        PID:3104
      - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
        6⤵
        
        PID:3268
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
        7⤵
        
        PID:5288
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
        7⤵
        
        PID:4944
        
        C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\
        8⤵
        
        PID:5076
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
        7⤵
        
        PID:3964
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
        7⤵
        
        PID:2060
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
        7⤵
        
        PID:5584
- - C:\Program Files\VideoLAN\backup.exe
    "C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
    3⤵
    PID:1704
  - - C:\Program Files\VideoLAN\VLC\backup.exe
      "C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
      4⤵
      PID:1504
    - - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\
        5⤵
        
        PID:5028
- - C:\Program Files\MSBuild\backup.exe
    "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
    3⤵
    PID:2764
- - C:\Program Files\Windows Defender\backup.exe
    "C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
    3⤵
    PID:1536
  - - C:\Program Files\Windows Defender\de-DE\backup.exe
      "C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
      4⤵
      PID:3464
  - - C:\Program Files\Windows Defender\es-ES\backup.exe
      "C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
      4⤵
      PID:1856
  - - C:\Program Files\Windows Defender\fr-FR\backup.exe
      "C:\Program Files\Windows Defender\fr-FR\backup.exe" C:\Program Files\Windows Defender\fr-FR\
      4⤵
      PID:4592
- - C:\Program Files\Microsoft Office\backup.exe
    "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
    3⤵
    PID:2464
- - C:\Program Files\Windows Mail\backup.exe
    "C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\
    3⤵
    PID:5664
- - C:\Program Files\Windows Portable Devices\backup.exe
    "C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
    3⤵
    PID:2224
- C:\PerfLogs\backup.exe
  C:\PerfLogs\backup.exe C:\PerfLogs\
  2⤵
  PID:2312
- C:\odt\backup.exe
  C:\odt\backup.exe C:\odt\
  2⤵
  PID:3080
- C:\Program Files (x86)\backup.exe
  "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
  2⤵
  PID:2832
- - C:\Program Files (x86)\Adobe\backup.exe
    "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
    3⤵
    PID:488
- - C:\Program Files (x86)\Common Files\backup.exe
    "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
    3⤵
    PID:4908
  - - C:\Program Files (x86)\Common Files\Oracle\backup.exe
      "C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\
      4⤵
      PID:5832
    - - C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\
        5⤵
        
        PID:3484
      - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\
        6⤵
        
        PID:2224
  - - C:\Program Files (x86)\Common Files\System\backup.exe
      "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
      4⤵
      PID:1348
    - - C:\Program Files (x86)\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\
        5⤵
        
        PID:4980
    - - C:\Program Files (x86)\Common Files\System\en-US\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\
        5⤵
        
        PID:1056
    - - C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\
        5⤵
        
        PID:5480
    - - C:\Program Files (x86)\Common Files\System\msadc\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
        5⤵
        
        PID:492
      - C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
        
        C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\
        6⤵
        
        PID:4008
    - - C:\Program Files (x86)\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\
        5⤵
        
        PID:6004
    - - C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\
        5⤵
        
        PID:3692
    - - C:\Program Files (x86)\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\
        5⤵
        
        PID:3212
    - - C:\Program Files (x86)\Common Files\System\ado\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
        5⤵
        
        PID:3804
  - - C:\Program Files (x86)\Common Files\Services\backup.exe
      "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
      4⤵
      PID:6020
- - C:\Program Files (x86)\Internet Explorer\backup.exe
    "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
    3⤵
    PID:224
  - - C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
      "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
      "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Internet Explorer\images\backup.exe
      "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
      "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
      "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
      "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
      4⤵
      PID:5620
    - - C:\Program Files (x86)\Google\Update\backup.exe
        
        "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
        5⤵
        
        PID:1372
    - - C:\Program Files (x86)\Google\Temp\backup.exe
        
        "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
        5⤵
        
        PID:492
  - - C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
      "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
      "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
      4⤵
      PID:4248
  - - C:\Program Files\Windows Photo Viewer\en-US\backup.exe
      "C:\Program Files\Windows Photo Viewer\en-US\backup.exe" C:\Program Files\Windows Photo Viewer\en-US\
      4⤵
      PID:3088
  - - C:\Program Files\Windows Photo Viewer\es-ES\backup.exe
      "C:\Program Files\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files\Windows Photo Viewer\es-ES\
      4⤵
      PID:524
  - - C:\Program Files\Windows Photo Viewer\de-DE\backup.exe
      "C:\Program Files\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files\Windows Photo Viewer\de-DE\
      4⤵
      PID:1160
- - C:\Program Files (x86)\Microsoft\backup.exe
    "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
    3⤵
    PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\backup.exe
      "C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\
      4⤵
      PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
        5⤵
        
        PID:536
  - - C:\Program Files (x86)\Microsoft\Temp\backup.exe
      "C:\Program Files (x86)\Microsoft\Temp\backup.exe" C:\Program Files (x86)\Microsoft\Temp\
      4⤵
      PID:1500
    - - C:\Program Files (x86)\Microsoft\Temp\EUD1B7.tmp\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EUD1B7.tmp\backup.exe" C:\Program Files (x86)\Microsoft\Temp\EUD1B7.tmp\
        5⤵
        
        PID:6004
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\
      4⤵
      PID:1372
    - - C:\Program Files (x86)\Google\Update\Download\data.exe
        
        "C:\Program Files (x86)\Google\Update\Download\data.exe" C:\Program Files (x86)\Google\Update\Download\
        5⤵
        
        PID:5816
    - - C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
        5⤵
        
        PID:2880
- - C:\Program Files (x86)\MSBuild\data.exe
    "C:\Program Files (x86)\MSBuild\data.exe" C:\Program Files (x86)\MSBuild\
    3⤵
    PID:2404
  - - C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
      "C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
      4⤵
      PID:976
    - - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\
        5⤵
        
        PID:2936
      - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
        6⤵
        
        PID:1800
      - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
        6⤵
        
        PID:4024
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\
        6⤵
        
        PID:5568
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
        6⤵
        
        PID:2944
        
        C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe
        
        C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\
        7⤵
        
        PID:3680
        
        C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
        8⤵
        
        PID:5696
        
        C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\update.exe
        
        C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\update.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\
        7⤵
        
        PID:5200
        
        C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:2448
        
        C:\Windows\assembly\GAC_64\mscorlib\backup.exe
        
        C:\Windows\assembly\GAC_64\mscorlib\backup.exe C:\Windows\assembly\GAC_64\mscorlib\
        7⤵
        
        PID:4008
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\
        8⤵
        
        PID:3556
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\
        9⤵
        
        PID:2068
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\
        9⤵
        
        PID:3268
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\
        9⤵
        
        PID:5560
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\
        9⤵
        
        PID:3208
        
        C:\Windows\assembly\GAC_64\PresentationCore\backup.exe
        
        C:\Windows\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\
        7⤵
        
        PID:4828
        
        C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\
        8⤵
        
        PID:5296
        
        C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe
        
        C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\
        7⤵
        
        PID:4188
        
        C:\Windows\assembly\GAC_64\System.Data\backup.exe
        
        C:\Windows\assembly\GAC_64\System.Data\backup.exe C:\Windows\assembly\GAC_64\System.Data\
        7⤵
        
        PID:2220
- - C:\Program Files (x86)\Mozilla Maintenance Service\update.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\update.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
    3⤵
    PID:2308
- - C:\Program Files (x86)\Reference Assemblies\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\backup.exe" C:\Program Files (x86)\Reference Assemblies\
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft.NET\backup.exe
    "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
    3⤵
    PID:2328
- - C:\Program Files (x86)\Windows Defender\backup.exe
    "C:\Program Files (x86)\Windows Defender\backup.exe" C:\Program Files (x86)\Windows Defender\
    3⤵
    PID:1648
  - - C:\Program Files (x86)\Windows Defender\de-DE\backup.exe
      "C:\Program Files (x86)\Windows Defender\de-DE\backup.exe" C:\Program Files (x86)\Windows Defender\de-DE\
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Windows Defender\es-ES\backup.exe
      "C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\
      4⤵
      PID:916
  - - C:\Program Files (x86)\Windows Defender\fr-FR\update.exe
      "C:\Program Files (x86)\Windows Defender\fr-FR\update.exe" C:\Program Files (x86)\Windows Defender\fr-FR\
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe
      "C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe" C:\Program Files (x86)\Windows Defender\ja-JP\
      4⤵
      PID:4032
- - C:\Program Files (x86)\Google\backup.exe
    "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
    3⤵
    PID:5620
- - C:\Program Files (x86)\Windows Mail\backup.exe
    "C:\Program Files (x86)\Windows Mail\backup.exe" C:\Program Files (x86)\Windows Mail\
    3⤵
    PID:2908
- - C:\Program Files (x86)\Windows Portable Devices\backup.exe
    "C:\Program Files (x86)\Windows Portable Devices\backup.exe" C:\Program Files (x86)\Windows Portable Devices\
    3⤵
    PID:1816
- C:\Users\backup.exe
  C:\Users\backup.exe C:\Users\
  2⤵
  PID:3652
- - C:\Users\Public\backup.exe
    C:\Users\Public\backup.exe C:\Users\Public\
    3⤵
    PID:1492
- C:\Windows\backup.exe
  C:\Windows\backup.exe C:\Windows\
  2⤵
  PID:2172
- - C:\Windows\es-ES\backup.exe
    C:\Windows\es-ES\backup.exe C:\Windows\es-ES\
    3⤵
    PID:1920
- - C:\Windows\fr-FR\backup.exe
    C:\Windows\fr-FR\backup.exe C:\Windows\fr-FR\
    3⤵
    PID:3492
- - C:\Windows\GameBarPresenceWriter\backup.exe
    C:\Windows\GameBarPresenceWriter\backup.exe C:\Windows\GameBarPresenceWriter\
    3⤵
    PID:1920
- - C:\Windows\IdentityCRL\backup.exe
    C:\Windows\IdentityCRL\backup.exe C:\Windows\IdentityCRL\
    3⤵
    PID:1368
  - - C:\Windows\IdentityCRL\INT\backup.exe
      C:\Windows\IdentityCRL\INT\backup.exe C:\Windows\IdentityCRL\INT\
      4⤵
      PID:6088

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:1828
- C:\Program Files\Common Files\microsoft shared\backup.exe
  "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
  2⤵
  PID:1240
- - C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
    "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
    3⤵
    PID:1624
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
      4⤵
      PID:744
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
      4⤵
      PID:4028
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
      4⤵
      PID:3692
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
      4⤵
      PID:3856
  - - C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\System Restore.exe
      "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
      4⤵
      PID:4528
- - C:\Program Files\Common Files\microsoft shared\OFFICE16\data.exe
    "C:\Program Files\Common Files\microsoft shared\OFFICE16\data.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
    3⤵
    PID:4176
  - - C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe
      "C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\legal\javafx\
      4⤵
      PID:4860
  - - C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe
      "C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\legal\jdk\
      4⤵
      PID:5084
- - C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
    "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
    3⤵
    PID:1832
- - C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
    "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
    3⤵
    PID:1372
  - - C:\Program Files (x86)\Google\Update\Install\backup.exe
      "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
      4⤵
      PID:2400
    - - C:\Program Files (x86)\Google\Update\Install\{622B5345-A3DF-4616-B086-BDE38350F13B}\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{622B5345-A3DF-4616-B086-BDE38350F13B}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{622B5345-A3DF-4616-B086-BDE38350F13B}\
        5⤵
        
        PID:3564
  - - C:\Program Files (x86)\Google\Update\Offline\backup.exe
      "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\backup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\
      4⤵
      PID:468
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{F9F3F80E-AACC-4150-A79E-E01DCD373B51}\backup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{F9F3F80E-AACC-4150-A79E-E01DCD373B51}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{F9F3F80E-AACC-4150-A79E-E01DCD373B51}\
        5⤵
        
        PID:5360
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\backup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Offline\
      4⤵
      PID:3284
    - - C:\Program Files\Java\jdk-1.8\legal\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\legal\backup.exe" C:\Program Files\Java\jdk-1.8\legal\
        5⤵
        
        PID:4176
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\
      4⤵
      PID:2208
- - C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
    "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
    3⤵
    PID:3756
  - - C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
      "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
      4⤵
      PID:5436
- - C:\Program Files\Common Files\microsoft shared\Triedit\System Restore.exe
    "C:\Program Files\Common Files\microsoft shared\Triedit\System Restore.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
    3⤵
    PID:5996
  - - C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
      "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\
      4⤵
      PID:1504
    - - C:\Program Files\VideoLAN\VLC\lua\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
        5⤵
        
        PID:4304
      - C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
        6⤵
        
        PID:2036
      - C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
        6⤵
        
        PID:464
        
        C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
        7⤵
        
        PID:4244
        
        C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
        8⤵
        
        PID:400
        
        C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
        7⤵
        
        PID:1692
      - C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
        6⤵
        
        PID:2220
        
        C:\Program Files\VideoLAN\VLC\lua\intf\modules\data.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\intf\modules\data.exe" C:\Program Files\VideoLAN\VLC\lua\intf\modules\
        7⤵
        
        PID:5604
        
        C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
        
        C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\
        7⤵
        
        PID:1820
      - C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
        6⤵
        
        PID:4156
        
        C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
        7⤵
        
        PID:5680
      - C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
        6⤵
        
        PID:1804
  - - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
      4⤵
      PID:4884
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\
        5⤵
        
        PID:2888
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\
        5⤵
        
        PID:2164
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\
        5⤵
        
        PID:2772
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\
        5⤵
        
        PID:4804
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\
        5⤵
        
        PID:2516
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\
        5⤵
        
        PID:1372
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\
        5⤵
        
        PID:5536
- - C:\Program Files\Common Files\microsoft shared\VC\backup.exe
    "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
    3⤵
    PID:4272
- - C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
    3⤵
    PID:3692
- C:\Program Files\Common Files\DESIGNER\backup.exe
  "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
  2⤵
  PID:4700

C:\Program Files\7-Zip\Lang\backup.exe
"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
1⤵
PID:2952

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
PID:1908

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\
1⤵
PID:2708

C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
1⤵
PID:4724

C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
1⤵
PID:6080

C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
1⤵
PID:5056

C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
1⤵
PID:1056

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\System Restore.exe
"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
1⤵
PID:2224

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
1⤵
PID:4780
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:3668
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
  2⤵
  PID:4620
- - C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1756
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
  2⤵
  PID:3040
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
  2⤵
  PID:564
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
  2⤵
  PID:5436
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\System Restore.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
  2⤵
  PID:744
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
  2⤵
  PID:2064
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
  2⤵
  PID:4844
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\
    3⤵
    PID:1892
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
  2⤵
  PID:2108
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
  2⤵
  PID:4264

C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
1⤵
PID:3716

C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
1⤵
PID:3396

C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
1⤵
PID:2880
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
  2⤵
  PID:2776

C:\Program Files\Common Files\microsoft shared\ink\he-IL\System Restore.exe
"C:\Program Files\Common Files\microsoft shared\ink\he-IL\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
1⤵
PID:4436

C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
1⤵
PID:6056

C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
1⤵
PID:5640

C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
1⤵
PID:5992

C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
1⤵
PID:5172

C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
1⤵
PID:4224

C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
1⤵
PID:3760

C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
1⤵
PID:5504
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\update.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\
  2⤵
  PID:6088

C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
1⤵
PID:5408

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
1⤵
PID:3460

C:\Program Files\Common Files\microsoft shared\ink\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
1⤵
PID:2368
- C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe
  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
  2⤵
  PID:4008
- C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
  2⤵
  PID:5116
- C:\Program Files\Common Files\microsoft shared\ink\ko-KR\update.exe
  "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\update.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
  2⤵
  PID:1492
- - C:\Users\Public\Downloads\backup.exe
    C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
    3⤵
    PID:664
  - - C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
      "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
      4⤵
      PID:884
    - - C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\data.exe
        
        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\data.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
        5⤵
        
        PID:2880
      - C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\data.exe
        
        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\data.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\
        6⤵
        
        PID:4588
  - - C:\Program Files\Microsoft Office\Updates\Download\backup.exe
      "C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\
      4⤵
      PID:1212
    - - C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\
        5⤵
        
        PID:5616
      - C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\
        6⤵
        
        PID:6088
        
        C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\
        7⤵
        
        PID:1192
        
        C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\
        8⤵
        
        PID:64
        
        C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\
        9⤵
        
        PID:5816
        
        C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\
        10⤵
        
        PID:2352
        
        C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\
        11⤵
        
        PID:3492
        
        C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
        10⤵
        
        PID:2036
- - C:\Users\Public\Music\backup.exe
    C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
    3⤵
    PID:4720
- - C:\Users\Public\Pictures\backup.exe
    C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
    3⤵
    PID:4476
- C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
  2⤵
  PID:3872
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\
    3⤵
    PID:3052
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\update.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\
      4⤵
      PID:184
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\
    3⤵
    PID:5780
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\
    3⤵
    PID:4984
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\
    3⤵
    PID:5408
- C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
  2⤵
  PID:1704
- C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
  2⤵
  PID:6088
- C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
  2⤵
  PID:5224
- C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
  2⤵
  PID:2872
- C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
  2⤵
  PID:5244
- C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
  2⤵
  PID:5236
- C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
  2⤵
  PID:3880
- C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\data.exe
  "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
  2⤵
  PID:1536
- C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
  2⤵
  PID:5360
- C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
  2⤵
  PID:400

C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
1⤵
PID:3948

C:\Program Files\Google\Chrome\Application\backup.exe
"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
1⤵
PID:4964
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
  2⤵
  PID:4220
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
    3⤵
    PID:4696
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\data.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\data.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
    3⤵
    PID:2104
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
    3⤵
    PID:2220
  - - C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe
      "C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\
      4⤵
      PID:4072
    - - C:\Windows\Globalization\Time Zone\backup.exe
        
        "C:\Windows\Globalization\Time Zone\backup.exe" C:\Windows\Globalization\Time Zone\
        5⤵
        
        PID:5624
- C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
  "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
  2⤵
  PID:2232

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
1⤵
PID:1896

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
1⤵
PID:3756
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
  2⤵
  PID:440

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
1⤵
PID:2416
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
  2⤵
  PID:3088
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
  2⤵
  PID:5056
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
  2⤵
  PID:5364
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
  2⤵
  PID:2880
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
  2⤵
  PID:2232
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\data.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
    3⤵
    PID:4736
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
      4⤵
      PID:2064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
    3⤵
    PID:4652
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
      4⤵
      PID:5068
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
    3⤵
    PID:2256
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
    3⤵
    PID:5048
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
  2⤵
  PID:4508
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
    3⤵
    PID:4512
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
  2⤵
  PID:3752
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
  2⤵
  PID:4608
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
  2⤵
  PID:1768
- C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:5328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
1⤵
PID:2396
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
  2⤵
  PID:3564
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
    3⤵
    PID:4492
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
    3⤵
    PID:4040

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:2668
- C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
  "C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
  2⤵
  PID:1132

C:\Program Files\Common Files\System\ado\backup.exe
"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
1⤵
PID:1596
- C:\Program Files\Common Files\System\ado\it-IT\backup.exe
  "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
  2⤵
  PID:664
- C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
  2⤵
  PID:5208
- C:\Program Files\Common Files\System\ado\es-ES\backup.exe
  "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
  2⤵
  PID:1372
- C:\Program Files\Common Files\System\ado\en-US\backup.exe
  "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
  2⤵
  PID:2544
- C:\Program Files\Common Files\System\ado\de-DE\backup.exe
  "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
  2⤵
  PID:5676

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
1⤵
PID:1856

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:5944

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
1⤵
PID:1700

C:\Program Files\Common Files\System\en-US\backup.exe
"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
1⤵
PID:2932

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
1⤵
PID:5252

C:\Users\Admin\3D Objects\backup.exe
"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
1⤵
PID:1932

C:\Program Files\Common Files\System\es-ES\backup.exe
"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
1⤵
PID:1112

C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
1⤵
PID:744

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
1⤵
PID:4936

C:\Program Files\Common Files\System\ja-JP\backup.exe
"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
1⤵
PID:1060

C:\Program Files\Common Files\System\msadc\backup.exe
"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
1⤵
PID:4020
- C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
  2⤵
  PID:3984
- C:\Program Files\Common Files\System\msadc\en-US\backup.exe
  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
  2⤵
  PID:1000
- C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
  2⤵
  PID:1704
- C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
  2⤵
  PID:5992

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
1⤵
PID:5256

C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
1⤵
PID:3724
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
  2⤵
  PID:1472
- - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
    3⤵
    PID:1540
  - - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
      4⤵
      PID:2952

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe
"C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\
1⤵
PID:2760

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
1⤵
PID:5676
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\
  2⤵
  PID:4740
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\f334dca9ae9dc06224e9b43875b3aa90\data.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\f334dca9ae9dc06224e9b43875b3aa90\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\f334dca9ae9dc06224e9b43875b3aa90\
  2⤵
  PID:976

C:\Users\Admin\Downloads\backup.exe
C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
1⤵
PID:6104
- C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
  2⤵
  PID:2496

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
1⤵
PID:4220
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
  2⤵
  PID:5456

C:\Users\Admin\Links\backup.exe
C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
1⤵
PID:4556

C:\Users\Admin\Music\backup.exe
C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
1⤵
PID:320

C:\Users\Admin\OneDrive\backup.exe
C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
1⤵
PID:3856

C:\Program Files\Java\jdk-1.8\jre\bin\update.exe
"C:\Program Files\Java\jdk-1.8\jre\bin\update.exe" C:\Program Files\Java\jdk-1.8\jre\bin\
1⤵
PID:6064
- C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\
  2⤵
  PID:2288

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
1⤵
PID:2332

C:\Users\Admin\Pictures\backup.exe
C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
1⤵
PID:4576
- C:\Users\Admin\Pictures\Camera Roll\data.exe
  "C:\Users\Admin\Pictures\Camera Roll\data.exe" C:\Users\Admin\Pictures\Camera Roll\
  2⤵
  PID:1468
- C:\Users\Admin\Pictures\Saved Pictures\backup.exe
  "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
  2⤵
  PID:3500
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\
    3⤵
    PID:5976
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\
      4⤵
      PID:4052
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\
        5⤵
        
        PID:4884
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\
        6⤵
        
        PID:1288
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\
        6⤵
        
        PID:4796
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\
        6⤵
        
        PID:2764
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\
        6⤵
        
        PID:3032
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\
        6⤵
        
        PID:3912
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\
        6⤵
        
        PID:4592
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\
        6⤵
        
        PID:1740
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\
        6⤵
        
        PID:1156
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\
        6⤵
        
        PID:2464
        
        C:\Program Files\Microsoft Office\Updates\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
        7⤵
        
        PID:664
      - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
        6⤵
        
        PID:4264
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\
        6⤵
        
        PID:3992
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\
        6⤵
        
        PID:3052
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\
        6⤵
        
        PID:1152
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\
    3⤵
    PID:4244
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\
      4⤵
      PID:6044
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\
    3⤵
    PID:1692
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\update.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\
      4⤵
      PID:3804
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\
        5⤵
        
        PID:5504
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\
        6⤵
        
        PID:2164
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\
        6⤵
        
        PID:6136
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\
        6⤵
        
        PID:812
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\
        6⤵
        
        PID:5356
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\
        6⤵
        
        PID:5568
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\
        6⤵
        
        PID:5992
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\
        6⤵
        
        PID:5304
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\
        6⤵
        
        PID:4084
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\
        6⤵
        
        PID:740
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\
        6⤵
        
        PID:4088
    - - C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
        5⤵
        
        PID:6080

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
1⤵
PID:4544

C:\Windows\addins\backup.exe
C:\Windows\addins\backup.exe C:\Windows\addins\
1⤵
PID:5084

C:\Program Files (x86)\Google\CrashReports\backup.exe
"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
1⤵
PID:5788

C:\Windows\appcompat\appraiser\backup.exe
C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
1⤵
PID:2228
- C:\Windows\appcompat\appraiser\Telemetry\backup.exe
  C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
  2⤵
  PID:3944

C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\
1⤵
PID:4228
- C:\Program Files\Java\jdk-1.8\jre\legal\javafx\update.exe
  "C:\Program Files\Java\jdk-1.8\jre\legal\javafx\update.exe" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\
  2⤵
  PID:1288
- C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\
  2⤵
  PID:1500

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
1⤵
PID:5068
- C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\
  2⤵
  PID:216
- - C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\
    3⤵
    PID:5128
  - - C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\
      4⤵
      PID:5768
    - - C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\
        5⤵
        
        PID:4612
  - - C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\System Restore.exe
      "C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\System Restore.exe" C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\
      4⤵
      PID:5164
  - - C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\
      4⤵
      PID:1740

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
1⤵
PID:4436

C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
1⤵
PID:5992

C:\Users\Admin\Searches\backup.exe
C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
1⤵
PID:5784

C:\Windows\appcompat\encapsulation\backup.exe
C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
1⤵
PID:5796

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
1⤵
PID:2408

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
1⤵
PID:2468
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
  2⤵
  PID:4704
- - C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\
    3⤵
    PID:3756
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
  2⤵
  PID:2260
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
  2⤵
  PID:5992

C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\
1⤵
PID:1628
- C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\
  2⤵
  PID:3892
- C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\
  2⤵
  PID:5788
- - C:\Windows\Branding\Basebrd\backup.exe
    C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\
    3⤵
    PID:1772
  - - C:\Windows\Branding\Basebrd\de-DE\backup.exe
      C:\Windows\Branding\Basebrd\de-DE\backup.exe C:\Windows\Branding\Basebrd\de-DE\
      4⤵
      PID:1624
  - - C:\Windows\Branding\Basebrd\en-US\backup.exe
      C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\
      4⤵
      PID:6044
  - - C:\Windows\Branding\Basebrd\it-IT\backup.exe
      C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\
      4⤵
      PID:1648
  - - C:\Windows\Branding\Basebrd\ja-JP\backup.exe
      C:\Windows\Branding\Basebrd\ja-JP\backup.exe C:\Windows\Branding\Basebrd\ja-JP\
      4⤵
      PID:2512
  - - C:\Windows\Branding\Basebrd\fr-FR\backup.exe
      C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\
      4⤵
      PID:2768
  - - C:\Windows\Branding\Basebrd\es-ES\backup.exe
      C:\Windows\Branding\Basebrd\es-ES\backup.exe C:\Windows\Branding\Basebrd\es-ES\
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe
      "C:\Program Files (x86)\Reference Assemblies\Microsoft\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\
      4⤵
      PID:2340
- - C:\Windows\Branding\shellbrd\backup.exe
    C:\Windows\Branding\shellbrd\backup.exe C:\Windows\Branding\shellbrd\
    3⤵
    PID:1596
- C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\images\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\
  2⤵
  PID:4588
- - C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\
    3⤵
    PID:3972
- C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\management\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\management\
  2⤵
  PID:4544
- - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\update.exe
    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
    3⤵
    PID:5996
- C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\security\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\
  2⤵
  PID:376
- - C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\
    3⤵
    PID:5408
  - - C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\
      4⤵
      PID:5612
  - - C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\
      4⤵
      PID:2980
    - - C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\
        5⤵
        
        PID:3268
      - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
        6⤵
        
        PID:6080

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
1⤵
PID:2936
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\
  2⤵
  PID:1500
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\
    3⤵
    PID:1924
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\
      4⤵
      PID:1576
    - - C:\Program Files\Windows Media Player\en-US\backup.exe
        
        "C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
        5⤵
        
        PID:2084
    - - C:\Program Files\Windows Media Player\es-ES\backup.exe
        
        "C:\Program Files\Windows Media Player\es-ES\backup.exe" C:\Program Files\Windows Media Player\es-ES\
        5⤵
        
        PID:4188
      - C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe
        
        C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\
        6⤵
        
        PID:4464
    - - C:\Program Files\Windows Media Player\it-IT\data.exe
        
        "C:\Program Files\Windows Media Player\it-IT\data.exe" C:\Program Files\Windows Media Player\it-IT\
        5⤵
        
        PID:3540
    - - C:\Program Files\Windows Media Player\Media Renderer\backup.exe
        
        "C:\Program Files\Windows Media Player\Media Renderer\backup.exe" C:\Program Files\Windows Media Player\Media Renderer\
        5⤵
        
        PID:5060
    - - C:\Program Files\Windows Media Player\Visualizations\data.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\data.exe" C:\Program Files\Windows Media Player\Visualizations\
        5⤵
        
        PID:5580
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\
      4⤵
      PID:2064
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\
        5⤵
        
        PID:1844

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
1⤵
PID:5280

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
1⤵
PID:3864
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\
  2⤵
  PID:5612

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\
1⤵
PID:1932

C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe
"C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\
1⤵
PID:5944

C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe
"C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe" C:\Program Files\Java\jre-1.8\bin\plugin2\
1⤵
PID:5124
- C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\es-ES\
  2⤵
  PID:4828
- C:\Program Files (x86)\Windows Photo Viewer\en-US\backup.exe
  "C:\Program Files (x86)\Windows Photo Viewer\en-US\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\en-US\
  2⤵
  PID:4852
- C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
  "C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
  2⤵
  PID:6028

C:\Windows\apppatch\Custom\backup.exe
C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
1⤵
PID:4656
- C:\Windows\apppatch\Custom\Custom64\backup.exe
  C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
  2⤵
  PID:2252
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\
  2⤵
  PID:2988

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\
1⤵
PID:3640

C:\Program Files\Java\jre-1.8\bin\server\backup.exe
"C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\
1⤵
PID:5228

C:\Windows\apppatch\CustomSDB\backup.exe
C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
1⤵
PID:3328

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\
1⤵
PID:3120

C:\Windows\apppatch\en-US\backup.exe
C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
1⤵
PID:1488

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\
1⤵
PID:2880
- C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
  2⤵
  PID:2256

C:\Windows\apppatch\es-ES\backup.exe
C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
1⤵
PID:1584

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:2300
- C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  PID:4464

C:\Windows\AppReadiness\backup.exe
C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
1⤵
PID:4176

C:\Windows\apppatch\it-IT\backup.exe
C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
1⤵
PID:3712

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\data.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\
1⤵
PID:2924
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\
  2⤵
  PID:3164
- - C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:5208
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\
  2⤵
  PID:2468
- - C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\
    3⤵
    PID:3492
- - C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\
    3⤵
    PID:3812
- - C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\
    3⤵
    PID:2784
- - C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
    3⤵
    PID:4588

C:\Windows\apppatch\ja-JP\backup.exe
C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\
1⤵
PID:5448

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\
1⤵
PID:5584
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\
  2⤵
  PID:2188
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\
    3⤵
    PID:548
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\System Restore.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\
  2⤵
  PID:4592
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\
    3⤵
    PID:6008
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\
      4⤵
      PID:832
  - - C:\Windows\Globalization\ELS\Transliteration\backup.exe
      C:\Windows\Globalization\ELS\Transliteration\backup.exe C:\Windows\Globalization\ELS\Transliteration\
      4⤵
      PID:1920
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\
  2⤵
  PID:5964
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\
    3⤵
    PID:1972
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\
  2⤵
  PID:5788
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\
  2⤵
  PID:5608

C:\Windows\assembly\backup.exe
C:\Windows\assembly\backup.exe C:\Windows\assembly\
1⤵
PID:4956
- C:\Windows\assembly\GAC\backup.exe
  C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
  2⤵
  PID:3984
- - C:\Windows\assembly\GAC\ADODB\backup.exe
    C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
    3⤵
    PID:3756
  - - C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\data.exe
      C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
      4⤵
      PID:1924
- - C:\Windows\assembly\GAC\Extensibility\backup.exe
    C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
    3⤵
    PID:6128
  - - C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
      C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
      4⤵
      PID:3932
- - C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe
    C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\
    3⤵
    PID:4924
  - - C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
      C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\
      4⤵
      PID:1108
- - C:\Windows\assembly\GAC\stdole\backup.exe
    C:\Windows\assembly\GAC\stdole\backup.exe C:\Windows\assembly\GAC\stdole\
    3⤵
    PID:5924
- - C:\Windows\assembly\GAC\MSDATASRC\backup.exe
    C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\
    3⤵
    PID:2980
- - C:\Windows\assembly\GAC\mscomctl\backup.exe
    C:\Windows\assembly\GAC\mscomctl\backup.exe C:\Windows\assembly\GAC\mscomctl\
    3⤵
    PID:5316
- - C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe
    C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\
    3⤵
    PID:5328
- C:\Windows\assembly\GAC_64\backup.exe
  C:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\
  2⤵
  PID:2944
- - C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe
    C:\Windows\assembly\GAC_64\ISymWrapper\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\
    3⤵
    PID:5348
  - - C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
      C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
      4⤵
      PID:5804
- - C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe
    C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\
    3⤵
    PID:4904
- - C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe
    C:\Windows\assembly\GAC_64\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\
    3⤵
    PID:1492
  - - C:\Users\Public\Videos\backup.exe
      C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
      4⤵
      PID:1672
  - - C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
      C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
      4⤵
      PID:2264
  - - C:\Users\Public\Documents\backup.exe
      C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
      4⤵
      PID:5716
- C:\Windows\assembly\GAC_32\backup.exe
  C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\
  2⤵
  PID:2280
- - C:\Windows\assembly\GAC_32\PresentationCore\System Restore.exe
    "C:\Windows\assembly\GAC_32\PresentationCore\System Restore.exe" C:\Windows\assembly\GAC_32\PresentationCore\
    3⤵
    PID:5964
- - C:\Windows\assembly\GAC_32\mscorlib\backup.exe
    C:\Windows\assembly\GAC_32\mscorlib\backup.exe C:\Windows\assembly\GAC_32\mscorlib\
    3⤵
    PID:492
- - C:\Windows\assembly\GAC_32\srmlib\data.exe
    C:\Windows\assembly\GAC_32\srmlib\data.exe C:\Windows\assembly\GAC_32\srmlib\
    3⤵
    PID:808
  - - C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe
      C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\
      4⤵
      PID:5936
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\
      4⤵
      PID:4300
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\
        5⤵
        
        PID:4528
      - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\
        6⤵
        
        PID:5808
      - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\
        6⤵
        
        PID:5720
- - C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe
    C:\Windows\assembly\GAC_32\System.EnterpriseServices\backup.exe C:\Windows\assembly\GAC_32\System.EnterpriseServices\
    3⤵
    PID:3468
- - C:\Windows\assembly\GAC_32\System.Web\backup.exe
    C:\Windows\assembly\GAC_32\System.Web\backup.exe C:\Windows\assembly\GAC_32\System.Web\
    3⤵
    PID:2876
  - - C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe
      C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\
      4⤵
      PID:3860
- C:\Windows\assembly\GAC_MSIL\backup.exe
  C:\Windows\assembly\GAC_MSIL\backup.exe C:\Windows\assembly\GAC_MSIL\
  2⤵
  PID:2852
- - C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe
    C:\Windows\assembly\GAC_MSIL\Accessibility\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\
    3⤵
    PID:2816
  - - C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe
      C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\
      4⤵
      PID:2608
- - C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe
    C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\
    3⤵
    PID:2500
  - - C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe
      C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\
      4⤵
      PID:4640
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\
        5⤵
        
        PID:3892
- - C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe
    C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\
    3⤵
    PID:3128
- - C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe
    C:\Windows\assembly\GAC_MSIL\IEExecRemote\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\
    3⤵
    PID:5616
  - - C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe
      C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\
      4⤵
      PID:4108
- - C:\Windows\assembly\GAC_MSIL\IEHost\backup.exe
    C:\Windows\assembly\GAC_MSIL\IEHost\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\
    3⤵
    PID:4620

C:\Program Files\Mozilla Firefox\browser\features\System Restore.exe
"C:\Program Files\Mozilla Firefox\browser\features\System Restore.exe" C:\Program Files\Mozilla Firefox\browser\features\
1⤵
PID:3460

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
1⤵
PID:1912
- C:\Program Files (x86)\Windows Media Player\en-US\data.exe
  "C:\Program Files (x86)\Windows Media Player\en-US\data.exe" C:\Program Files (x86)\Windows Media Player\en-US\
  2⤵
  PID:2312
- C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe
  "C:\Program Files (x86)\Windows Media Player\es-ES\backup.exe" C:\Program Files (x86)\Windows Media Player\es-ES\
  2⤵
  PID:2908
- C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\
  2⤵
  PID:1908
- C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe
  "C:\Program Files (x86)\Windows Media Player\Network Sharing\backup.exe" C:\Program Files (x86)\Windows Media Player\Network Sharing\
  2⤵
  PID:1736

C:\Program Files\Mozilla Firefox\browser\VisualElements\data.exe
"C:\Program Files\Mozilla Firefox\browser\VisualElements\data.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
1⤵
PID:400

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\data.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\
1⤵
PID:32

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\
1⤵
PID:4244
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\
  2⤵
  PID:2440

C:\Program Files (x86)\Common Files\System\ado\en-US\update.exe
"C:\Program Files (x86)\Common Files\System\ado\en-US\update.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
1⤵
PID:5320

C:\Program Files (x86)\Common Files\Microsoft Shared\VC\data.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VC\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VC\
1⤵
PID:3120

C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
1⤵
PID:2028

C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\
1⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
1⤵
PID:6012

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\
1⤵
PID:2388
- C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\
  2⤵
  PID:1556
- - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\
    3⤵
    PID:3716
- C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\
  2⤵
  PID:1628
- - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\
    3⤵
    PID:2768
- - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\
    3⤵
    PID:2368
- - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\
    3⤵
    PID:2104
- - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\
    3⤵
    PID:2228
- - C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\jfr\
    3⤵
    PID:2328
- - C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\fonts\
    3⤵
    PID:832
- - C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\ext\
    3⤵
    PID:4956
  - - C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\
      4⤵
      PID:180
    - - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\
        5⤵
        
        PID:5320
      - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\
        6⤵
        
        PID:1492
      - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\
        6⤵
        
        PID:1592
    - - C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\
        5⤵
        
        PID:2764
      - C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\
        6⤵
        
        PID:5672
    - - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\System\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\
        5⤵
        
        PID:3988
  - - C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\
      4⤵
      PID:5420
    - - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\
        5⤵
        
        PID:2824
      - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\
        6⤵
        
        PID:1488
  - - C:\Windows\assembly\NativeImages_v4.0.30319_32\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_32\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\
      4⤵
      PID:2388
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\update.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\update.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\
        5⤵
        
        PID:2064
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\
        5⤵
        
        PID:3148
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\
      4⤵
      PID:5032
- - C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\applet\
    3⤵
    PID:5768
- - C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\
    3⤵
    PID:1104

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
1⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\update.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\update.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
1⤵
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\System Restore.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\
  2⤵
  PID:2152

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
1⤵
PID:3840

C:\Program Files\MSBuild\Microsoft\backup.exe
"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
1⤵
PID:5216
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
  2⤵
  PID:6092

C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe
C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\
1⤵
PID:1904

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\84CB2D97-720A-4CA7-AE34-B9EB973F43EA\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\
1⤵
PID:548

C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\
1⤵
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\
  2⤵
  PID:2636
- - C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
    "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
    3⤵
    PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\
1⤵
PID:5664

C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\logs\
1⤵
PID:1404

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:4512

C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
1⤵
PID:2596

C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\
1⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\
1⤵
PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\
  2⤵
  PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\backup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\
    3⤵
    PID:3056

C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\
1⤵
PID:1904
- C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
  2⤵
  PID:5336
- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4692

C:\Program Files (x86)\Common Files\System\msadc\fr-FR\System Restore.exe
"C:\Program Files (x86)\Common Files\System\msadc\fr-FR\System Restore.exe" C:\Program Files (x86)\Common Files\System\msadc\fr-FR\
1⤵
PID:832

C:\Windows\CbsTemp\backup.exe
C:\Windows\CbsTemp\backup.exe C:\Windows\CbsTemp\
1⤵
PID:3724

C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\
1⤵
PID:5956

C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe
C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\
1⤵
PID:1152

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\
1⤵
PID:2988
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\
  2⤵
  PID:3212
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\
  2⤵
  PID:4940

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\
1⤵
PID:4432
- C:\Program Files\Mozilla Firefox\browser\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
  2⤵
  PID:2156

C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\
1⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\
1⤵
PID:4436

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:5812

C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\
1⤵
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\System Restore.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\
  2⤵
  PID:1356
- - C:\Users\Admin\Saved Games\backup.exe
    "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
    3⤵
    PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\
  2⤵
  PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\
    3⤵
    PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\
  2⤵
  PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\backup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\
    3⤵
    PID:4892

C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\
1⤵
PID:5156

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\
1⤵
PID:4880

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\
1⤵
PID:3788

C:\Windows\de-DE\backup.exe
C:\Windows\de-DE\backup.exe C:\Windows\de-DE\
1⤵
PID:5360

C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
1⤵
PID:5484
- C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
  2⤵
  PID:5572

C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\
1⤵
PID:1408

C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:564

C:\Windows\DiagTrack\data.exe
C:\Windows\DiagTrack\data.exe C:\Windows\DiagTrack\
1⤵
PID:4804
- C:\Windows\DiagTrack\Scenarios\backup.exe
  C:\Windows\DiagTrack\Scenarios\backup.exe C:\Windows\DiagTrack\Scenarios\
  2⤵
  PID:4564
- C:\Windows\DiagTrack\Settings\backup.exe
  C:\Windows\DiagTrack\Settings\backup.exe C:\Windows\DiagTrack\Settings\
  2⤵
  PID:3664

C:\Program Files\VideoLAN\VLC\locale\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
1⤵
PID:1244
- C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
  2⤵
  PID:4832
- C:\Program Files\VideoLAN\VLC\locale\am\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\am\data.exe" C:\Program Files\VideoLAN\VLC\locale\am\
  2⤵
  PID:6064
- - C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\server\
    3⤵
    PID:5584
- - C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\
    3⤵
    PID:2708
- C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
  2⤵
  PID:3492
- - C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
    3⤵
    PID:1972
- C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
  2⤵
  PID:5428
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\
    3⤵
    PID:4676
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\
      4⤵
      PID:724
- C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
  2⤵
  PID:1060
- C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
  2⤵
  PID:1164

C:\Windows\assembly\GAC_32\MSBuild\backup.exe
C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\
1⤵
PID:3908

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\
1⤵
PID:2084

C:\Windows\debug\backup.exe
C:\Windows\debug\backup.exe C:\Windows\debug\
1⤵
PID:344

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
1⤵
PID:2440

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\
1⤵
PID:4100

C:\Windows\Cursors\System Restore.exe
"C:\Windows\Cursors\System Restore.exe" C:\Windows\Cursors\
1⤵
PID:1908

C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2612

C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\
1⤵
PID:1536

C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\update.exe
C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\update.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
1⤵
PID:3164

C:\Windows\Containers\serviced\backup.exe
C:\Windows\Containers\serviced\backup.exe C:\Windows\Containers\serviced\
1⤵
PID:2972

C:\Windows\Containers\backup.exe
C:\Windows\Containers\backup.exe C:\Windows\Containers\
1⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\
1⤵
PID:3356

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\
1⤵
PID:4600

C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe
C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\
1⤵
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\data.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\data.exe" C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\
1⤵
PID:1736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\
1⤵
PID:2696
- C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
  2⤵
  PID:3384
- C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\System Restore.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\
  2⤵
  PID:4716
- C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\control\
  2⤵
  PID:5360
- C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
  2⤵
  PID:3760
- C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d9\
  2⤵
  PID:2544
- C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\demux\
  2⤵
  PID:5484
- C:\Program Files\VideoLAN\VLC\plugins\logger\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\plugins\logger\System Restore.exe" C:\Program Files\VideoLAN\VLC\plugins\logger\
  2⤵
  PID:5956
- C:\Program Files\VideoLAN\VLC\plugins\keystore\update.exe
  "C:\Program Files\VideoLAN\VLC\plugins\keystore\update.exe" C:\Program Files\VideoLAN\VLC\plugins\keystore\
  2⤵
  PID:3540
- C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\gui\
  2⤵
  PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\
1⤵
PID:6064

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe
"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\
1⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\
1⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\
1⤵
PID:1856

C:\Windows\Branding\backup.exe
C:\Windows\Branding\backup.exe C:\Windows\Branding\
1⤵
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\
1⤵
PID:5480
- C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\
  2⤵
  PID:1816
- C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\
  2⤵
  PID:5152
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\
    3⤵
    PID:4424
- C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\
  2⤵
  PID:1664

C:\Windows\bcastdvr\backup.exe
C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\
1⤵
PID:4292

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\
1⤵
PID:3500
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\
  2⤵
  PID:1500
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\
    3⤵
    PID:4532
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\
      4⤵
      PID:3484
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\
        5⤵
        
        PID:64
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\
        5⤵
        
        PID:1408
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\
        5⤵
        
        PID:4980
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\
        5⤵
        
        PID:4792
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\
        5⤵
        
        PID:1220
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\
        5⤵
        
        PID:952
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\
        5⤵
        
        PID:3964
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\
        5⤵
        
        PID:4612
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\
        5⤵
        
        PID:968
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\data.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\
        5⤵
        
        PID:376
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\
  2⤵
  PID:5616
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\
    3⤵
    PID:3720
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\
      4⤵
      PID:4740
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\
    3⤵
    PID:2924
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\
      4⤵
      PID:4492
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\
  2⤵
  PID:964
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\
  2⤵
  PID:3800
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\
    3⤵
    PID:5320
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\System Restore.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\
      4⤵
      PID:4988
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\
  2⤵
  PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
1⤵
PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\
  2⤵
  PID:4908
- - C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
    3⤵
    PID:5032
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\
      4⤵
      PID:4304
    - - C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\586ed23cb27e69e90eee6d49206356b8\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\586ed23cb27e69e90eee6d49206356b8\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\586ed23cb27e69e90eee6d49206356b8\
        5⤵
        
        PID:1128
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\
      4⤵
      PID:5976
- - C:\Program Files (x86)\Common Files\Java\backup.exe
    "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
    3⤵
    PID:4188
- - C:\Program Files\Windows NT\Accessories\en-US\backup.exe
    "C:\Program Files\Windows NT\Accessories\en-US\backup.exe" C:\Program Files\Windows NT\Accessories\en-US\
    3⤵
    PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\
  2⤵
  PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\backup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\
    3⤵
    PID:5492
  - - C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe
      C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\
      4⤵
      PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\
  2⤵
  PID:5112

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\update.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\
1⤵
PID:5976

C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\data.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\
1⤵
PID:4412

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\
1⤵
PID:6100

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\
1⤵
PID:2500

C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\
1⤵
PID:1032

C:\Windows\apppatch\fr-FR\backup.exe
C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\
1⤵
PID:3044

C:\Windows\apppatch\de-DE\backup.exe
C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
1⤵
PID:2368

C:\Windows\apppatch\AppPatch64\update.exe
C:\Windows\apppatch\AppPatch64\update.exe C:\Windows\apppatch\AppPatch64\
1⤵
PID:2264

C:\Windows\apppatch\backup.exe
C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
1⤵
PID:2004

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
1⤵
PID:1916

C:\Windows\appcompat\Programs\backup.exe
C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
1⤵
PID:3192

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
1⤵
PID:1236

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
1⤵
PID:2232
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\
  2⤵
  PID:5152
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\
  2⤵
  PID:5608

C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
1⤵
PID:4836

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:2132

C:\Windows\DigitalLocker\backup.exe
C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\
1⤵
PID:6068
- C:\Windows\DigitalLocker\en-US\backup.exe
  C:\Windows\DigitalLocker\en-US\backup.exe C:\Windows\DigitalLocker\en-US\
  2⤵
  PID:1972

C:\Windows\en-US\backup.exe
C:\Windows\en-US\backup.exe C:\Windows\en-US\
1⤵
PID:6012

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:2872

C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
1⤵
PID:648

C:\Windows\appcompat\backup.exe
C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
1⤵
PID:2304

C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
1⤵
PID:2936

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
1⤵
PID:1924

C:\Program Files\Common Files\System\Ole DB\de-DE\data.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\data.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:5132
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\
  2⤵
  PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:2000

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\
1⤵
PID:1572

C:\Windows\Help\Help\data.exe
C:\Windows\Help\Help\data.exe C:\Windows\Help\Help\
1⤵
PID:3908

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\System Restore.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\
1⤵
PID:764

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\
1⤵
PID:3208

C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\
1⤵
PID:3720

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\
1⤵
PID:2376

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\
1⤵
PID:5544

C:\Windows\Help\mui\backup.exe
C:\Windows\Help\mui\backup.exe C:\Windows\Help\mui\
1⤵
PID:4072

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
1⤵
PID:3580

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\
1⤵
PID:4844

C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\
1⤵
PID:2972

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\
1⤵
PID:5244

C:\Windows\Help\en-US\update.exe
C:\Windows\Help\en-US\update.exe C:\Windows\Help\en-US\
1⤵
PID:1132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
122KB

MD5
bac603890d1e2fb7e352518e24005b05

SHA1
83a5a8112fb2a84cf86a845b32306802cab5f241

SHA256
3b559f4494c4b0a02332d2b293edf701d9aa8d0a8c39395e198a20bf0b2a0bad

SHA512
48aa5d150c526a829189d8e6c7972f6499b27b821a4ea90a227ccd1476c0f74bbaa48b9bcb37299e4b70714bdb66eee0377d8f5a8c4e1ba95eac23ffbceecf14

Download Submit
C:\PerfLogs\backup.exe

Filesize
122KB

MD5
bac603890d1e2fb7e352518e24005b05

SHA1
83a5a8112fb2a84cf86a845b32306802cab5f241

SHA256
3b559f4494c4b0a02332d2b293edf701d9aa8d0a8c39395e198a20bf0b2a0bad

SHA512
48aa5d150c526a829189d8e6c7972f6499b27b821a4ea90a227ccd1476c0f74bbaa48b9bcb37299e4b70714bdb66eee0377d8f5a8c4e1ba95eac23ffbceecf14

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
122KB

MD5
c6794a9418e51ae675e86a5b9795250c

SHA1
c10cb9e3b87baadc7ae903c365384ab973dbf981

SHA256
2b80a1856a6e6c5b2ce46bd2b161c81f663b35ff94a131493f5d4359eba62590

SHA512
9f08f52db7ced2a47c7bf6aedeac525693c3bbb792cb3b306182b9ddd38b664dabc0a1df6c4697d8b48d1801c8c231a59fa03418340fcc2895b413a2bdaca2f6

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
122KB

MD5
c6794a9418e51ae675e86a5b9795250c

SHA1
c10cb9e3b87baadc7ae903c365384ab973dbf981

SHA256
2b80a1856a6e6c5b2ce46bd2b161c81f663b35ff94a131493f5d4359eba62590

SHA512
9f08f52db7ced2a47c7bf6aedeac525693c3bbb792cb3b306182b9ddd38b664dabc0a1df6c4697d8b48d1801c8c231a59fa03418340fcc2895b413a2bdaca2f6

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
122KB

MD5
c671dd569173db2b3c2ac135b5380366

SHA1
5a4cde8bd196688106f7a0937c7aa24648c2b8f2

SHA256
8228f4d4bc9fee50f0c811396695936d81eef16bfdc4930fda10d94a43c7040f

SHA512
c7c9f6e3ea244853e217441231e936c422a64e76c21a50b75cbbe54585e9460ffeefa1d5bdf3b59591bc12eb3918a470156223c6e7cf1faed5d669055cc8805f

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
122KB

MD5
c671dd569173db2b3c2ac135b5380366

SHA1
5a4cde8bd196688106f7a0937c7aa24648c2b8f2

SHA256
8228f4d4bc9fee50f0c811396695936d81eef16bfdc4930fda10d94a43c7040f

SHA512
c7c9f6e3ea244853e217441231e936c422a64e76c21a50b75cbbe54585e9460ffeefa1d5bdf3b59591bc12eb3918a470156223c6e7cf1faed5d669055cc8805f

Download Submit
C:\Program Files\Common Files\DESIGNER\backup.exe

Filesize
122KB

MD5
dfc4ef7a59afeb6f66760f19a770098c

SHA1
fd375507fd11eac4f4fc30fbfcec0ddc12b50ea7

SHA256
5d1c811881f37f7200e681b48e2139dc8ea20f3c7e9707e2badaf3641ede1682

SHA512
d8be5cb3694d64aa04b3dd74acc83e95b84c72336ffd7ccb9e44936257b079a1a7b4fdd629ca7e82faebd60d27ac783d2ecdd5f2bab8b7e93cc1f56c934eb530

Download Submit
C:\Program Files\Common Files\DESIGNER\backup.exe

Filesize
122KB

MD5
dfc4ef7a59afeb6f66760f19a770098c

SHA1
fd375507fd11eac4f4fc30fbfcec0ddc12b50ea7

SHA256
5d1c811881f37f7200e681b48e2139dc8ea20f3c7e9707e2badaf3641ede1682

SHA512
d8be5cb3694d64aa04b3dd74acc83e95b84c72336ffd7ccb9e44936257b079a1a7b4fdd629ca7e82faebd60d27ac783d2ecdd5f2bab8b7e93cc1f56c934eb530

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
122KB

MD5
c671dd569173db2b3c2ac135b5380366

SHA1
5a4cde8bd196688106f7a0937c7aa24648c2b8f2

SHA256
8228f4d4bc9fee50f0c811396695936d81eef16bfdc4930fda10d94a43c7040f

SHA512
c7c9f6e3ea244853e217441231e936c422a64e76c21a50b75cbbe54585e9460ffeefa1d5bdf3b59591bc12eb3918a470156223c6e7cf1faed5d669055cc8805f

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
122KB

MD5
c671dd569173db2b3c2ac135b5380366

SHA1
5a4cde8bd196688106f7a0937c7aa24648c2b8f2

SHA256
8228f4d4bc9fee50f0c811396695936d81eef16bfdc4930fda10d94a43c7040f

SHA512
c7c9f6e3ea244853e217441231e936c422a64e76c21a50b75cbbe54585e9460ffeefa1d5bdf3b59591bc12eb3918a470156223c6e7cf1faed5d669055cc8805f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

Filesize
122KB

MD5
60d78f7326d5d0174205c7526760d715

SHA1
6eefdb6712f7adc78e5c4d7e7766f46bcd7589f0

SHA256
1cc07a40ee2bc3967e51186a4be50ed6e98f51447c58f55833ff9ab9e74c4545

SHA512
78481337fd4f83680fe311e3c4762069b9d6cf7a89660a2b98ae125d1716a0fd0869e4c2a047c0db1087688513fb0eaac9b9d6fffea48b52fd882f92c8f0672d

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

Filesize
122KB

MD5
60d78f7326d5d0174205c7526760d715

SHA1
6eefdb6712f7adc78e5c4d7e7766f46bcd7589f0

SHA256
1cc07a40ee2bc3967e51186a4be50ed6e98f51447c58f55833ff9ab9e74c4545

SHA512
78481337fd4f83680fe311e3c4762069b9d6cf7a89660a2b98ae125d1716a0fd0869e4c2a047c0db1087688513fb0eaac9b9d6fffea48b52fd882f92c8f0672d

Download Submit
C:\Program Files\Common Files\microsoft shared\backup.exe

Filesize
122KB

MD5
dfc4ef7a59afeb6f66760f19a770098c

SHA1
fd375507fd11eac4f4fc30fbfcec0ddc12b50ea7

SHA256
5d1c811881f37f7200e681b48e2139dc8ea20f3c7e9707e2badaf3641ede1682

SHA512
d8be5cb3694d64aa04b3dd74acc83e95b84c72336ffd7ccb9e44936257b079a1a7b4fdd629ca7e82faebd60d27ac783d2ecdd5f2bab8b7e93cc1f56c934eb530

Download Submit
C:\Program Files\Common Files\microsoft shared\backup.exe

Filesize
122KB

MD5
dfc4ef7a59afeb6f66760f19a770098c

SHA1
fd375507fd11eac4f4fc30fbfcec0ddc12b50ea7

SHA256
5d1c811881f37f7200e681b48e2139dc8ea20f3c7e9707e2badaf3641ede1682

SHA512
d8be5cb3694d64aa04b3dd74acc83e95b84c72336ffd7ccb9e44936257b079a1a7b4fdd629ca7e82faebd60d27ac783d2ecdd5f2bab8b7e93cc1f56c934eb530

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\backup.exe

Filesize
122KB

MD5
60d78f7326d5d0174205c7526760d715

SHA1
6eefdb6712f7adc78e5c4d7e7766f46bcd7589f0

SHA256
1cc07a40ee2bc3967e51186a4be50ed6e98f51447c58f55833ff9ab9e74c4545

SHA512
78481337fd4f83680fe311e3c4762069b9d6cf7a89660a2b98ae125d1716a0fd0869e4c2a047c0db1087688513fb0eaac9b9d6fffea48b52fd882f92c8f0672d

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\backup.exe

Filesize
122KB

MD5
60d78f7326d5d0174205c7526760d715

SHA1
6eefdb6712f7adc78e5c4d7e7766f46bcd7589f0

SHA256
1cc07a40ee2bc3967e51186a4be50ed6e98f51447c58f55833ff9ab9e74c4545

SHA512
78481337fd4f83680fe311e3c4762069b9d6cf7a89660a2b98ae125d1716a0fd0869e4c2a047c0db1087688513fb0eaac9b9d6fffea48b52fd882f92c8f0672d

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

Filesize
122KB

MD5
18d8a40c993cab26e2d3da0c7b6f86dd

SHA1
f43da9427e66465f7af4bcce2faa0a971fa2a9a9

SHA256
de0ff12a99da7fa29c09eda4a3fccd60f851e5f3d187f8984ab86f82d98b64ea

SHA512
26e05af4251e6d00e6e16701ae3034f003de90e0e78087837acac0995e27a52b699ae25667f60ab256048bde818d48ba072cb5d9986800f0602e04b5970856aa

Download Submit
C:\Program Files\backup.exe

Filesize
122KB

MD5
bac603890d1e2fb7e352518e24005b05

SHA1
83a5a8112fb2a84cf86a845b32306802cab5f241

SHA256
3b559f4494c4b0a02332d2b293edf701d9aa8d0a8c39395e198a20bf0b2a0bad

SHA512
48aa5d150c526a829189d8e6c7972f6499b27b821a4ea90a227ccd1476c0f74bbaa48b9bcb37299e4b70714bdb66eee0377d8f5a8c4e1ba95eac23ffbceecf14

Download Submit
C:\Program Files\backup.exe

Filesize
122KB

MD5
bac603890d1e2fb7e352518e24005b05

SHA1
83a5a8112fb2a84cf86a845b32306802cab5f241

SHA256
3b559f4494c4b0a02332d2b293edf701d9aa8d0a8c39395e198a20bf0b2a0bad

SHA512
48aa5d150c526a829189d8e6c7972f6499b27b821a4ea90a227ccd1476c0f74bbaa48b9bcb37299e4b70714bdb66eee0377d8f5a8c4e1ba95eac23ffbceecf14

Download Submit
C:\Users\Admin\AppData\Local\Temp\282813517\backup.exe

Filesize
122KB

MD5
531c5b40049f278c3d65642da62a545e

SHA1
6a59d31031a5c87e0ee8a0d39dd7eafaa14371a6

SHA256
b109c11796c8a0d99515ab1e919897fe59eb69b56d20decb20ad162552611dfa

SHA512
3be0a922c6b3dc8b3c4da582db4bdd79e673603b59eb6d463d4bcf8569a3e4c490818c304e9c5e12653c8abc832eb2d544cff00f874eb21bf7c9ea2e1e081c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\282813517\backup.exe

Filesize
122KB

MD5
531c5b40049f278c3d65642da62a545e

SHA1
6a59d31031a5c87e0ee8a0d39dd7eafaa14371a6

SHA256
b109c11796c8a0d99515ab1e919897fe59eb69b56d20decb20ad162552611dfa

SHA512
3be0a922c6b3dc8b3c4da582db4bdd79e673603b59eb6d463d4bcf8569a3e4c490818c304e9c5e12653c8abc832eb2d544cff00f874eb21bf7c9ea2e1e081c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\282813517\backup.exe

Filesize
122KB

MD5
531c5b40049f278c3d65642da62a545e

SHA1
6a59d31031a5c87e0ee8a0d39dd7eafaa14371a6

SHA256
b109c11796c8a0d99515ab1e919897fe59eb69b56d20decb20ad162552611dfa

SHA512
3be0a922c6b3dc8b3c4da582db4bdd79e673603b59eb6d463d4bcf8569a3e4c490818c304e9c5e12653c8abc832eb2d544cff00f874eb21bf7c9ea2e1e081c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\data.exe

Filesize
122KB

MD5
c3722f19f02fd5ee12a5fcb2efda3c42

SHA1
77de2473fd6723f778881401e894e3214f577e99

SHA256
c1e77901e1b0add70b14fc91516aa1c793cfc3482ac20e8a5b53610a6ecc7723

SHA512
f2e66aca9dd47c41412be34caba29b1b8b7b746ba7b0baf90d64d7298edc7b20735ed2fa165a9fa47c07beb6ccab6d1b0b0d64bdf7f0d71c611b2a641e3e602b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\data.exe

Filesize
122KB

MD5
c3722f19f02fd5ee12a5fcb2efda3c42

SHA1
77de2473fd6723f778881401e894e3214f577e99

SHA256
c1e77901e1b0add70b14fc91516aa1c793cfc3482ac20e8a5b53610a6ecc7723

SHA512
f2e66aca9dd47c41412be34caba29b1b8b7b746ba7b0baf90d64d7298edc7b20735ed2fa165a9fa47c07beb6ccab6d1b0b0d64bdf7f0d71c611b2a641e3e602b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

Filesize
122KB

MD5
c6609d44f7bd558be673293daf8d4c2d

SHA1
4e88b922f61ea3a902bf35cce876e8b72dede2d7

SHA256
0787adb556acddeb02da819f95e13089fd92887b24987dd24875d08c7af7c5a2

SHA512
3437997e9041823de968f92a4b20042c172a582dfbf38f02cf783485c5e1fa031a047852d9acd9797660a1915344b77ba83e34dcb79526c17bd03d1db0db717a

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

Filesize
122KB

MD5
c6609d44f7bd558be673293daf8d4c2d

SHA1
4e88b922f61ea3a902bf35cce876e8b72dede2d7

SHA256
0787adb556acddeb02da819f95e13089fd92887b24987dd24875d08c7af7c5a2

SHA512
3437997e9041823de968f92a4b20042c172a582dfbf38f02cf783485c5e1fa031a047852d9acd9797660a1915344b77ba83e34dcb79526c17bd03d1db0db717a

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
122KB

MD5
9ca4657cca56623241bb337fc44a2261

SHA1
44390d86fd12a65a2f941cb3df82bad7138d233d

SHA256
6fe0f040d1e582c749b3f591430890d955c9574a998ef91564af94312c82ef9e

SHA512
2b203e3233de7d7fdf8041131942640543f0b7d6076e6186d00227bda7f0bbcf5a5ae85f3460305d1f370e4272f98609f2ecb021b265a56d2c03e545c3e0889f

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
41KB

MD5
f7fdcdfa145f7b746d86ff47f165a349

SHA1
49e13cc77ae85a3fa9ffebdddad7940991be98a1

SHA256
df90c7b3ed16a5a8134e238ad9d8f0f3167e29eb0e8e37e7c1dc1f6c3cb8715a

SHA512
752a516931c7f647300cfe1c290b57ce04c7df39903b99f6a2cfc17370199d476fb8ec37eef8ae7cd4600f6bd6f28686fdf1dcde50edca64d3f75d7430b57b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\{62E26D9F-BAEE-4D69-BE8F-82A5AD67D75E}\backup.exe

Filesize
122KB

MD5
531c5b40049f278c3d65642da62a545e

SHA1
6a59d31031a5c87e0ee8a0d39dd7eafaa14371a6

SHA256
b109c11796c8a0d99515ab1e919897fe59eb69b56d20decb20ad162552611dfa

SHA512
3be0a922c6b3dc8b3c4da582db4bdd79e673603b59eb6d463d4bcf8569a3e4c490818c304e9c5e12653c8abc832eb2d544cff00f874eb21bf7c9ea2e1e081c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{62E26D9F-BAEE-4D69-BE8F-82A5AD67D75E}\backup.exe

Filesize
122KB

MD5
531c5b40049f278c3d65642da62a545e

SHA1
6a59d31031a5c87e0ee8a0d39dd7eafaa14371a6

SHA256
b109c11796c8a0d99515ab1e919897fe59eb69b56d20decb20ad162552611dfa

SHA512
3be0a922c6b3dc8b3c4da582db4bdd79e673603b59eb6d463d4bcf8569a3e4c490818c304e9c5e12653c8abc832eb2d544cff00f874eb21bf7c9ea2e1e081c33

Download Submit
C:\backup.exe

Filesize
122KB

MD5
03c3f3bb3dd02c6135f53c49483fe211

SHA1
86d4497475fa56e5d999eba4e0b38b37a3022ff2

SHA256
dd2f81e67626be150e2ad77cee6d2e35277417fdb85f790585b7c1fb9c64c553

SHA512
9f1a2e50eb2a9a5fc3f035a197d6ad119ae08cad29ed9249c1d1f7015d57eafcfb564439ca4274468266f16193be8db5171ffa632157542e4d62b9f4caf23d78

Download Submit
C:\backup.exe

Filesize
122KB

MD5
03c3f3bb3dd02c6135f53c49483fe211

SHA1
86d4497475fa56e5d999eba4e0b38b37a3022ff2

SHA256
dd2f81e67626be150e2ad77cee6d2e35277417fdb85f790585b7c1fb9c64c553

SHA512
9f1a2e50eb2a9a5fc3f035a197d6ad119ae08cad29ed9249c1d1f7015d57eafcfb564439ca4274468266f16193be8db5171ffa632157542e4d62b9f4caf23d78

Download Submit
C:\odt\backup.exe

Filesize
122KB

MD5
bac603890d1e2fb7e352518e24005b05

SHA1
83a5a8112fb2a84cf86a845b32306802cab5f241

SHA256
3b559f4494c4b0a02332d2b293edf701d9aa8d0a8c39395e198a20bf0b2a0bad

SHA512
48aa5d150c526a829189d8e6c7972f6499b27b821a4ea90a227ccd1476c0f74bbaa48b9bcb37299e4b70714bdb66eee0377d8f5a8c4e1ba95eac23ffbceecf14

Download Submit
C:\odt\backup.exe

Filesize
122KB

MD5
bac603890d1e2fb7e352518e24005b05

SHA1
83a5a8112fb2a84cf86a845b32306802cab5f241

SHA256
3b559f4494c4b0a02332d2b293edf701d9aa8d0a8c39395e198a20bf0b2a0bad

SHA512
48aa5d150c526a829189d8e6c7972f6499b27b821a4ea90a227ccd1476c0f74bbaa48b9bcb37299e4b70714bdb66eee0377d8f5a8c4e1ba95eac23ffbceecf14

Download Submit
memory/64-79-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/400-665-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/440-461-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/564-300-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/632-185-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/744-310-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/744-597-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1056-271-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1240-236-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1372-684-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1492-405-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1596-664-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1624-596-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1676-31-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1704-429-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1828-207-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1856-610-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1896-412-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1908-142-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1980-617-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2064-315-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2104-440-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2108-325-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2112-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2112-360-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2112-221-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2112-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2220-428-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2224-276-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2232-658-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2288-619-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2312-107-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2368-252-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2396-469-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2544-659-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2668-661-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2708-80-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-702-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2784-82-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2832-446-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2880-703-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2880-342-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2952-138-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2956-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2980-504-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3040-295-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3068-165-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3080-99-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3396-357-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3460-189-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3492-110-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3492-157-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3668-285-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3692-668-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3716-347-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3756-471-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3760-214-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3860-510-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3872-416-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3880-638-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3948-175-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4008-375-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4028-637-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4220-620-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4220-487-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4224-218-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4264-320-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4388-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4388-351-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4388-76-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4436-338-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4528-683-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4576-539-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4620-290-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4640-629-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4696-459-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4700-161-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4720-541-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4724-241-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4780-332-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4780-327-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4844-331-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4964-660-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4964-470-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5056-266-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5116-389-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5160-92-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5160-453-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5172-226-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5208-710-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5224-455-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5236-590-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5244-562-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5324-59-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5324-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5360-700-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5408-196-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5436-305-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5456-51-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5504-203-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5640-248-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5676-624-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5680-611-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5796-445-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5796-662-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5944-618-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5992-233-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6048-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6056-256-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6080-261-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6088-439-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/6092-732-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download