034bf6c6c975d39330987ac7a65661862dda64dc945f42bc528a32e2e3954c4e

Analysis

max time kernel
154s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2023, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.de77514ed381529f5fc34c159633a750.exe
Size

338KB
MD5

de77514ed381529f5fc34c159633a750
SHA1

63514c345c1b156b74f4ea1e0eccf03241daa51b
SHA256

034bf6c6c975d39330987ac7a65661862dda64dc945f42bc528a32e2e3954c4e
SHA512

4dd6302a43fede1e24ed591e3168c2b7245f1cfc0c5c36c9b8e53b0b396a99f2b7adac11c0bc6b1db8b2d6c34d4c12eae2d405ef24d149862c015545fc63f504
SSDEEP

3072:BmVwRKCrIYlW9dLKEl4MC0iFixWS1WC2P9/KvY:BmVn6O4Ep3s7BZT

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	NEAS.de77514ed381529f5fc34c159633a750.exe

Executes dropped EXE 1 IoCs

pid	Process
3344	backup.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/880-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0003000000022308-6.dat	upx
behavioral2/files/0x0003000000022308-7.dat	upx
behavioral2/files/0x000a000000022bff-13.dat	upx
behavioral2/memory/1148-14-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x000a000000022bff-12.dat	upx
behavioral2/files/0x000a000000022bff-11.dat	upx
behavioral2/files/0x0009000000022bf7-20.dat	upx
behavioral2/files/0x0009000000022bf7-19.dat	upx
behavioral2/files/0x0008000000022bfa-26.dat	upx
behavioral2/files/0x0008000000022bfa-25.dat	upx
behavioral2/memory/1148-28-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2404-32-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0007000000022ceb-35.dat	upx
behavioral2/files/0x0007000000022ceb-34.dat	upx
behavioral2/files/0x0007000000022cec-41.dat	upx
behavioral2/files/0x0006000000022cee-47.dat	upx
behavioral2/files/0x0006000000022cee-46.dat	upx
behavioral2/files/0x0007000000022cec-39.dat	upx
behavioral2/memory/2028-51-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0006000000022cef-53.dat	upx
behavioral2/files/0x0006000000022cef-54.dat	upx
behavioral2/memory/3912-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0007000000022cf1-62.dat	upx
behavioral2/memory/880-61-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0007000000022cf1-60.dat	upx
behavioral2/files/0x0009000000022ce6-69.dat	upx
behavioral2/memory/4376-68-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3344-74-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0007000000022cf2-75.dat	upx
behavioral2/files/0x0007000000022cf2-73.dat	upx
behavioral2/files/0x0009000000022ce6-67.dat	upx
behavioral2/memory/400-80-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x000a000000022ce9-83.dat	upx
behavioral2/files/0x000a000000022ce9-82.dat	upx
behavioral2/files/0x0007000000022cf4-89.dat	upx
behavioral2/memory/1432-88-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0007000000022cf4-87.dat	upx
behavioral2/files/0x0007000000022cf6-94.dat	upx
behavioral2/files/0x0007000000022cf6-96.dat	upx
behavioral2/files/0x0006000000022cf9-104.dat	upx
behavioral2/memory/3068-103-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0006000000022cf9-102.dat	upx
behavioral2/memory/4692-95-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4200-113-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0008000000022cf5-112.dat	upx
behavioral2/files/0x0006000000022cf8-118.dat	upx
behavioral2/files/0x0006000000022cf8-117.dat	upx
behavioral2/files/0x0008000000022ce4-124.dat	upx
behavioral2/files/0x0007000000022cf0-129.dat	upx
behavioral2/files/0x0007000000022cf0-130.dat	upx
behavioral2/memory/2536-142-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0007000000022cfb-147.dat	upx
behavioral2/files/0x0007000000022cfb-146.dat	upx
behavioral2/memory/3900-141-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0007000000022cf7-140.dat	upx
behavioral2/memory/4780-138-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1196-137-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0007000000022cf7-139.dat	upx
behavioral2/files/0x0006000000022cfe-157.dat	upx
behavioral2/files/0x0006000000022cff-156.dat	upx
behavioral2/files/0x0006000000022cfe-155.dat	upx
behavioral2/files/0x0006000000022cff-153.dat	upx
behavioral2/files/0x0009000000022cfc-167.dat	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
880	NEAS.de77514ed381529f5fc34c159633a750.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3344	880	backup.exe	90
PID 880 wrote to memory of 3344	880	backup.exe	90
PID 880 wrote to memory of 3344	880	backup.exe	90

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.de77514ed381529f5fc34c159633a750.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.de77514ed381529f5fc34c159633a750.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:880
- C:\Users\Admin\AppData\Local\Temp\{AAA56600-45B8-4EF4-8ABF-C11D728EFCF9}\backup.exe
  C:\Users\Admin\AppData\Local\Temp\{AAA56600-45B8-4EF4-8ABF-C11D728EFCF9}\backup.exe C:\Users\Admin\AppData\Local\Temp\{AAA56600-45B8-4EF4-8ABF-C11D728EFCF9}\
  2⤵
  - Executes dropped EXE
  PID:3344
- - C:\backup.exe
    \backup.exe \
    3⤵
    PID:3068
  - - C:\odt\backup.exe
      C:\odt\backup.exe C:\odt\
      4⤵
      PID:2028
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      PID:4376
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      PID:2536
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        
        PID:3884
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        
        PID:820
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        
        PID:2100
      - C:\Program Files\Common Files\Services\backup.exe
        
        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
        6⤵
        
        PID:3492
      - C:\Program Files\Common Files\System\backup.exe
        
        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
        6⤵
        
        PID:4172
        
        C:\Program Files\Common Files\System\ado\backup.exe
        
        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
        7⤵
        
        PID:3360
        
        C:\Program Files\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
        8⤵
        
        PID:2684
        
        C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        8⤵
        
        PID:4656
        
        C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
        9⤵
        
        PID:652
        
        C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        8⤵
        
        PID:3976
        
        C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        8⤵
        
        PID:4208
        
        C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        8⤵
        
        PID:652
        
        C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
        8⤵
        
        PID:2876
        
        C:\Program Files\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
        7⤵
        
        PID:748
        
        C:\Program Files\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
        7⤵
        
        PID:2864
        
        C:\Program Files\Common Files\System\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
        7⤵
        
        PID:4456
        
        C:\Program Files\Common Files\System\msadc\System Restore.exe
        
        "C:\Program Files\Common Files\System\msadc\System Restore.exe" C:\Program Files\Common Files\System\msadc\
        7⤵
        
        PID:4440
        
        C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
        8⤵
        
        PID:3948
        
        C:\Program Files\Common Files\System\msadc\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
        8⤵
        
        PID:4532
        
        C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
        8⤵
        
        PID:2916
        
        C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
        8⤵
        
        PID:4456
        
        C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
        9⤵
        
        PID:2540
        
        C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
        8⤵
        
        PID:5044
        
        C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
        8⤵
        
        PID:4648
        
        C:\Program Files\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
        7⤵
        
        PID:3008
        
        C:\Program Files\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
        7⤵
        
        PID:216
        
        C:\Program Files\Common Files\System\Ole DB\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
        7⤵
        
        PID:4656
        
        C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
        8⤵
        
        PID:1140
        
        C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
        8⤵
        
        PID:2468
        
        C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
        8⤵
        
        PID:1148
        
        C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
        8⤵
        
        PID:1532
        
        C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
        8⤵
        
        PID:4212
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        
        PID:3500
      - C:\Program Files\Google\Chrome\backup.exe
        
        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
        6⤵
        
        PID:4532
        
        C:\Program Files\Google\Chrome\Application\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
        7⤵
        
        PID:3668
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\update.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\update.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
        8⤵
        
        PID:3648
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
        9⤵
        
        PID:1708
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
        9⤵
        
        PID:4376
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
        9⤵
        
        PID:4248
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
        9⤵
        
        PID:5056
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
        9⤵
        
        PID:1140
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\update.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\update.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
        9⤵
        
        PID:3880
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
        9⤵
        
        PID:1492
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
        10⤵
        
        PID:1348
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
        11⤵
        
        PID:1992
        
        C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
        8⤵
        
        PID:3988
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        
        PID:4380
      - C:\Program Files\Internet Explorer\de-DE\backup.exe
        
        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
        6⤵
        
        PID:2276
      - C:\Program Files\Internet Explorer\en-US\update.exe
        
        "C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\
        6⤵
        
        PID:3064
      - C:\Program Files\Internet Explorer\es-ES\backup.exe
        
        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
        6⤵
        
        PID:4208
      - C:\Program Files\Internet Explorer\fr-FR\backup.exe
        
        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
        6⤵
        
        PID:4764
      - C:\Program Files\Internet Explorer\images\backup.exe
        
        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
        6⤵
        
        PID:2696
      - C:\Program Files\Internet Explorer\it-IT\backup.exe
        
        "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
        6⤵
        
        PID:1568
      - C:\Program Files\Internet Explorer\SIGNUP\backup.exe
        
        "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
        6⤵
        
        PID:4388
      - C:\Program Files\Internet Explorer\ja-JP\backup.exe
        
        "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
        6⤵
        
        PID:3992
    - - C:\Program Files\Java\backup.exe
        
        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
        5⤵
        
        PID:772
      - C:\Program Files\Java\jre-1.8\backup.exe
        
        "C:\Program Files\Java\jre-1.8\backup.exe" C:\Program Files\Java\jre-1.8\
        6⤵
        
        PID:4192
        
        C:\Program Files\Java\jre-1.8\legal\backup.exe
        
        "C:\Program Files\Java\jre-1.8\legal\backup.exe" C:\Program Files\Java\jre-1.8\legal\
        7⤵
        
        PID:4308
        
        C:\Program Files\Java\jre-1.8\legal\javafx\update.exe
        
        "C:\Program Files\Java\jre-1.8\legal\javafx\update.exe" C:\Program Files\Java\jre-1.8\legal\javafx\
        8⤵
        
        PID:3912
        
        C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe
        
        "C:\Program Files\Java\jre-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jre-1.8\legal\jdk\
        8⤵
        
        PID:392
        
        C:\Program Files\Java\jre-1.8\lib\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\backup.exe" C:\Program Files\Java\jre-1.8\lib\
        7⤵
        
        PID:404
        
        C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe" C:\Program Files\Java\jre-1.8\lib\amd64\
        8⤵
        
        PID:4496
        
        C:\Program Files\Java\jre-1.8\lib\applet\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\applet\backup.exe" C:\Program Files\Java\jre-1.8\lib\applet\
        8⤵
        
        PID:852
        
        C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe" C:\Program Files\Java\jre-1.8\lib\deploy\
        8⤵
        
        PID:2684
        
        C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\cmm\backup.exe" C:\Program Files\Java\jre-1.8\lib\cmm\
        8⤵
        
        PID:4540
        
        C:\Program Files\Java\jre-1.8\lib\ext\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\ext\backup.exe" C:\Program Files\Java\jre-1.8\lib\ext\
        8⤵
        
        PID:4864
        
        C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\jfr\backup.exe" C:\Program Files\Java\jre-1.8\lib\jfr\
        8⤵
        
        PID:5456
        
        C:\Program Files\Java\jre-1.8\lib\management\backup.exe
        
        "C:\Program Files\Java\jre-1.8\lib\management\backup.exe" C:\Program Files\Java\jre-1.8\lib\management\
        8⤵
        
        PID:5788
    - - C:\Program Files\Microsoft Office\backup.exe
        
        "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
        5⤵
        
        PID:3544
      - C:\Program Files\Microsoft Office\Updates\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
        6⤵
        
        PID:1528
        
        C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
        7⤵
        
        PID:4816
        
        C:\Program Files\Microsoft Office\Updates\Download\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\
        7⤵
        
        PID:3068
        
        C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\
        8⤵
        
        PID:3308
        
        C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\
        9⤵
        
        PID:2292
        
        C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\
        10⤵
        
        PID:4380
    - - C:\Program Files\Microsoft Office 15\backup.exe
        
        "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
        5⤵
        
        PID:4536
      - C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
        6⤵
        
        PID:2108
    - - C:\Program Files\Mozilla Firefox\backup.exe
        
        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
        5⤵
        
        PID:1160
      - C:\Program Files\Mozilla Firefox\defaults\backup.exe
        
        "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
        6⤵
        
        PID:4880
        
        C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
        
        "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
        7⤵
        
        PID:4988
      - C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
        
        "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
        6⤵
        
        PID:8
        
        C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
        
        "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
        7⤵
        
        PID:544
      - C:\Program Files\Mozilla Firefox\fonts\backup.exe
        
        "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
        6⤵
        
        PID:4372
    - - C:\Program Files\MSBuild\backup.exe
        
        "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
        5⤵
        
        PID:3760
      - C:\Program Files\MSBuild\Microsoft\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
        6⤵
        
        PID:3416
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
        7⤵
        
        PID:4044
      - C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\
        6⤵
        
        PID:6016
    - - C:\Program Files\Reference Assemblies\backup.exe
        
        "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
        5⤵
        
        PID:556
    - - C:\Program Files\VideoLAN\backup.exe
        
        "C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
        5⤵
        
        PID:1668
    - - C:\Program Files\Windows Multimedia Platform\backup.exe
        
        "C:\Program Files\Windows Multimedia Platform\backup.exe" C:\Program Files\Windows Multimedia Platform\
        5⤵
        
        PID:1492
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      PID:760
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        
        PID:3920
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
        6⤵
        
        PID:3468
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\data.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
        7⤵
        
        PID:2980
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
        7⤵
        
        PID:4340
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
        8⤵
        
        PID:3988
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
        9⤵
        
        PID:5028
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
        8⤵
        
        PID:4324
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
        9⤵
        
        PID:3956
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
        8⤵
        
        PID:2984
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
        8⤵
        
        PID:3880
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
        8⤵
        
        PID:1584
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
        9⤵
        
        PID:2148
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
        8⤵
        
        PID:4844
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
        9⤵
        
        PID:2400
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
        8⤵
        
        PID:232
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
        8⤵
        
        PID:1324
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
        9⤵
        
        PID:4248
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
        8⤵
        
        PID:3116
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
        9⤵
        
        PID:3320
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\
        10⤵
        
        PID:5712
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\
        11⤵
        
        PID:1792
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\
        12⤵
        
        PID:4072
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\
        12⤵
        
        PID:3860
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\
        12⤵
        
        PID:1920
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\
        12⤵
        
        PID:5632
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\
        12⤵
        
        PID:5444
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\
        12⤵
        
        PID:5644
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
        8⤵
        
        PID:4068
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
        9⤵
        
        PID:2804
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
        10⤵
        
        PID:4356
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
        9⤵
        
        PID:844
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
        10⤵
        
        PID:3116
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
        9⤵
        
        PID:852
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
        8⤵
        
        PID:1580
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
        9⤵
        
        PID:948
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
        8⤵
        
        PID:4980
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
        8⤵
        
        PID:3796
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
        8⤵
        
        PID:4716
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
        9⤵
        
        PID:1980
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
        7⤵
        
        PID:4492
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
        8⤵
        
        PID:3848
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
        9⤵
        
        PID:4152
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
        8⤵
        
        PID:2232
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
        9⤵
        
        PID:1896
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
        10⤵
        
        PID:4988
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
        10⤵
        
        PID:4204
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
        11⤵
        
        PID:1984
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
        11⤵
        
        PID:2288
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
        8⤵
        
        PID:3500
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
        7⤵
        
        PID:4368
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
        8⤵
        
        PID:560
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        
        PID:2072
      - C:\Program Files (x86)\Common Files\Adobe\data.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\data.exe" C:\Program Files (x86)\Common Files\Adobe\
        6⤵
        
        PID:2332
        
        C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
        7⤵
        
        PID:2724
        
        C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
        7⤵
        
        PID:2468
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
        7⤵
        
        PID:2764
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
        8⤵
        
        PID:3884
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
        9⤵
        
        PID:1336
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
        10⤵
        
        PID:2804
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
        11⤵
        
        PID:2364
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
        11⤵
        
        PID:1880
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
        12⤵
        
        PID:3772
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\
        13⤵
        
        PID:4820
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\
        14⤵
        
        PID:4792
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\
        14⤵
        
        PID:468
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\update.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\
        14⤵
        
        PID:3060
        
        C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
        10⤵
        
        PID:2744
        
        C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
        7⤵
        
        PID:1580
      - C:\Program Files (x86)\Common Files\Microsoft Shared\update.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
        6⤵
        
        PID:1872
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\
        7⤵
        
        PID:3988
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
        8⤵
        
        PID:1524
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\
        7⤵
        
        PID:4804
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\
        8⤵
        
        PID:4372
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\
        8⤵
        
        PID:2272
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\
        7⤵
        
        PID:1036
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\
        7⤵
        
        PID:1204
        
        C:\Windows\apppatch\ja-JP\backup.exe
        
        C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\
        8⤵
        
        PID:3796
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\
        8⤵
        
        PID:4764
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\
        7⤵
        
        PID:4932
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\
        7⤵
        
        PID:3380
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VC\
        7⤵
        
        PID:1392
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\
        7⤵
        
        PID:468
        
        C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\
        8⤵
        
        PID:4640
      - C:\Program Files (x86)\Common Files\Services\backup.exe
        
        "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
        6⤵
        
        PID:4076
      - C:\Program Files (x86)\Common Files\System\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
        6⤵
        
        PID:4188
        
        C:\Program Files (x86)\Common Files\System\ado\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
        7⤵
        
        PID:4988
        
        C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
        8⤵
        
        PID:1724
        
        C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
        8⤵
        
        PID:1140
        
        C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
        8⤵
        
        PID:4456
        
        C:\Program Files (x86)\Common Files\System\ado\fr-FR\System Restore.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
        8⤵
        
        PID:2400
        
        C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
        8⤵
        
        PID:2688
        
        C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
        8⤵
        
        PID:4428
        
        C:\Program Files (x86)\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\
        7⤵
        
        PID:4216
        
        C:\Program Files (x86)\Common Files\System\en-US\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\
        7⤵
        
        PID:1980
        
        C:\Program Files (x86)\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\
        7⤵
        
        PID:2540
        
        C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\
        7⤵
        
        PID:5028
        
        C:\Program Files (x86)\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\
        7⤵
        
        PID:3948
        
        C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
        7⤵
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:880
        
        C:\Program Files (x86)\Common Files\System\msadc\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\
        7⤵
        
        PID:772
        
        C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\it-IT\
        8⤵
        
        PID:6136
        
        C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\ja-JP\
        8⤵
        
        PID:5492
      - C:\Program Files (x86)\Common Files\Oracle\backup.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\
        6⤵
        
        PID:3256
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
        7⤵
        
        PID:4880
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\
        8⤵
        
        PID:1568
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\
        8⤵
        
        PID:3892
      - C:\Program Files (x86)\Common Files\Java\backup.exe
        
        "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
        6⤵
        
        PID:3364
    - - C:\Program Files (x86)\Google\data.exe
        
        "C:\Program Files (x86)\Google\data.exe" C:\Program Files (x86)\Google\
        5⤵
        
        PID:420
      - C:\Program Files (x86)\Google\CrashReports\backup.exe
        
        "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
        6⤵
        
        PID:3944
      - C:\Program Files (x86)\Google\Update\backup.exe
        
        "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
        6⤵
        
        PID:4852
        
        C:\Program Files (x86)\Google\Update\Install\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
        7⤵
        
        PID:1280
        
        C:\Program Files (x86)\Google\Update\Install\{18238221-87DD-468B-83D3-9DB71CA592AF}\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{18238221-87DD-468B-83D3-9DB71CA592AF}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{18238221-87DD-468B-83D3-9DB71CA592AF}\
        8⤵
        
        PID:4372
        
        C:\Program Files (x86)\Google\Update\Offline\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
        7⤵
        
        PID:400
      - C:\Program Files (x86)\Google\Temp\backup.exe
        
        "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
        6⤵
        
        PID:4876
        
        C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\System Restore.exe
        
        "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\System Restore.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
        7⤵
        
        PID:1896
    - - C:\Program Files (x86)\Internet Explorer\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
        5⤵
        
        PID:3972
      - C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
        6⤵
        
        PID:4648
      - C:\Program Files (x86)\Internet Explorer\it-IT\update.exe
        
        "C:\Program Files (x86)\Internet Explorer\it-IT\update.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
        6⤵
        
        PID:232
      - C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
        6⤵
        
        PID:560
      - C:\Program Files (x86)\Internet Explorer\images\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
        6⤵
        
        PID:4292
        
        C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\
        7⤵
        
        PID:5368
      - C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
        6⤵
        
        PID:1148
      - C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
        6⤵
        
        PID:1584
      - C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
        6⤵
        
        PID:1500
      - C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
        6⤵
        
        PID:2752
    - - C:\Program Files (x86)\Microsoft\backup.exe
        
        "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
        5⤵
        
        PID:3648
      - C:\Program Files (x86)\Microsoft\Edge\System Restore.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\
        6⤵
        
        PID:4648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
        7⤵
        
        PID:1524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
        8⤵
        
        PID:4492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
        9⤵
        
        PID:3900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
        9⤵
        
        PID:1120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\
        10⤵
        
        PID:2864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\
        10⤵
        
        PID:4340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\
        9⤵
        
        PID:548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\
        9⤵
        
        PID:4880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\
        9⤵
        
        PID:3464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\update.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\update.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\
        9⤵
        
        PID:4140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\
        9⤵
        
        PID:2448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\
        9⤵
        
        PID:5236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\
        9⤵
        
        PID:5628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\
        10⤵
        
        PID:3060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\
        10⤵
        
        PID:5584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\
        10⤵
        
        PID:2452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\
        11⤵
        
        PID:5728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\update.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\update.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\
        9⤵
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\
        8⤵
        
        PID:4792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\
        8⤵
        
        PID:5004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\update.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\update.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\
        8⤵
        
        PID:6008
      - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\
        6⤵
        
        PID:1612
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\backup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\
        7⤵
        
        PID:4788
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\
        7⤵
        
        PID:4240
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\
        8⤵
        
        PID:3860
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\
        7⤵
        
        PID:4692
        
        C:\Program Files (x86)\Windows Defender\de-DE\update.exe
        
        "C:\Program Files (x86)\Windows Defender\de-DE\update.exe" C:\Program Files (x86)\Windows Defender\de-DE\
        8⤵
        
        PID:4372
        
        C:\Program Files (x86)\Windows Defender\es-ES\backup.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\
        8⤵
        
        PID:3148
        
        C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe
        
        "C:\Program Files (x86)\Windows Defender\fr-FR\backup.exe" C:\Program Files (x86)\Windows Defender\fr-FR\
        8⤵
        
        PID:5160
        
        C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Windows Defender\ja-JP\backup.exe" C:\Program Files (x86)\Windows Defender\ja-JP\
        8⤵
        
        PID:2072
        
        C:\Program Files (x86)\Windows Defender\it-IT\backup.exe
        
        "C:\Program Files (x86)\Windows Defender\it-IT\backup.exe" C:\Program Files (x86)\Windows Defender\it-IT\
        8⤵
        
        PID:5836
      - C:\Program Files (x86)\Microsoft\Temp\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\backup.exe" C:\Program Files (x86)\Microsoft\Temp\
        6⤵
        
        PID:4192
    - - C:\Program Files (x86)\Microsoft.NET\backup.exe
        
        "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
        5⤵
        
        PID:4372
      - C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\
        6⤵
        
        PID:3892
      - C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\
        6⤵
        
        PID:4980
    - - C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
        5⤵
        
        PID:3676
    - - C:\Program Files (x86)\MSBuild\backup.exe
        
        "C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\
        5⤵
        
        PID:2820
      - C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
        6⤵
        
        PID:3928
    - - C:\Program Files (x86)\Reference Assemblies\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\backup.exe" C:\Program Files (x86)\Reference Assemblies\
        5⤵
        
        PID:3712
      - C:\Program Files (x86)\Reference Assemblies\Microsoft\System Restore.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\System Restore.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\
        6⤵
        
        PID:5576
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\
        7⤵
        
        PID:1896
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\
        8⤵
        
        PID:2708
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
        9⤵
        
        PID:3504
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\
        9⤵
        
        PID:5888
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\
        9⤵
        
        PID:5504
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\
        9⤵
        
        PID:5724
    - - C:\Program Files (x86)\Windows Mail\System Restore.exe
        
        "C:\Program Files (x86)\Windows Mail\System Restore.exe" C:\Program Files (x86)\Windows Mail\
        5⤵
        
        PID:1852
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      PID:4544
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        
        PID:220
      - C:\Users\Admin\3D Objects\backup.exe
        
        "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
        6⤵
        
        PID:4128
      - C:\Users\Admin\Contacts\backup.exe
        
        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
        6⤵
        
        PID:2904
      - C:\Users\Admin\Documents\data.exe
        
        C:\Users\Admin\Documents\data.exe C:\Users\Admin\Documents\
        6⤵
        
        PID:2864
        
        C:\Users\Admin\Documents\OneNote Notebooks\backup.exe
        
        "C:\Users\Admin\Documents\OneNote Notebooks\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\
        7⤵
        
        PID:2836
        
        C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe
        
        "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\
        8⤵
        
        PID:2716
        
        C:\Windows\appcompat\appraiser\Telemetry\backup.exe
        
        C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
        8⤵
        
        PID:3888
      - C:\Users\Admin\Desktop\update.exe
        
        C:\Users\Admin\Desktop\update.exe C:\Users\Admin\Desktop\
        6⤵
        
        PID:4320
      - C:\Users\Admin\Favorites\backup.exe
        
        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
        6⤵
        
        PID:2004
      - C:\Users\Admin\Links\backup.exe
        
        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
        6⤵
        
        PID:548
      - C:\Users\Admin\Pictures\System Restore.exe
        
        "C:\Users\Admin\Pictures\System Restore.exe" C:\Users\Admin\Pictures\
        6⤵
        
        PID:4520
        
        C:\Users\Admin\Pictures\Saved Pictures\backup.exe
        
        "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
        7⤵
        
        PID:4104
        
        C:\Users\Admin\Pictures\Camera Roll\backup.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
        7⤵
        
        PID:4816
        
        C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\update.exe
        
        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\update.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
        8⤵
        
        PID:548
        
        C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\
        9⤵
        
        PID:4172
      - C:\Users\Admin\OneDrive\backup.exe
        
        C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
        6⤵
        
        PID:1668
      - C:\Users\Admin\Music\update.exe
        
        C:\Users\Admin\Music\update.exe C:\Users\Admin\Music\
        6⤵
        
        PID:1260
      - C:\Users\Admin\Saved Games\backup.exe
        
        "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
        6⤵
        
        PID:4544
      - C:\Users\Admin\Searches\update.exe
        
        C:\Users\Admin\Searches\update.exe C:\Users\Admin\Searches\
        6⤵
        
        PID:2196
      - C:\Users\Admin\Videos\backup.exe
        
        C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
        6⤵
        
        PID:2708
      - C:\Users\Admin\Downloads\backup.exe
        
        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
        6⤵
        
        PID:4488
    - - C:\Users\Public\backup.exe
        
        C:\Users\Public\backup.exe C:\Users\Public\
        5⤵
        
        PID:1756
      - C:\Users\Public\Downloads\backup.exe
        
        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
        6⤵
        
        PID:948
      - C:\Users\Public\Videos\backup.exe
        
        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
        6⤵
        
        PID:3096
      - C:\Users\Public\Pictures\backup.exe
        
        C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
        6⤵
        
        PID:1280
      - C:\Users\Public\Music\update.exe
        
        C:\Users\Public\Music\update.exe C:\Users\Public\Music\
        6⤵
        
        PID:4376
      - C:\Users\Public\Documents\backup.exe
        
        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
        6⤵
        
        PID:5096
        
        C:\Program Files\Java\jdk-1.8\include\win32\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\include\win32\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\
        7⤵
        
        PID:884
  - - C:\Windows\System Restore.exe
      "C:\Windows\System Restore.exe" C:\Windows\
      4⤵
      PID:1360
    - - C:\Windows\appcompat\backup.exe
        
        C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
        5⤵
        
        PID:4320
      - C:\Windows\appcompat\encapsulation\backup.exe
        
        C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
        6⤵
        
        PID:4736
      - C:\Windows\appcompat\appraiser\backup.exe
        
        C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
        6⤵
        
        PID:2836
      - C:\Windows\appcompat\Programs\backup.exe
        
        C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
        6⤵
        
        PID:4092
    - - C:\Windows\apppatch\data.exe
        
        C:\Windows\apppatch\data.exe C:\Windows\apppatch\
        5⤵
        
        PID:1204
      - C:\Windows\apppatch\AppPatch64\backup.exe
        
        C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
        6⤵
        
        PID:2724
      - C:\Windows\apppatch\Custom\backup.exe
        
        C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
        6⤵
        
        PID:4780
        
        C:\Windows\apppatch\Custom\Custom64\backup.exe
        
        C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
        7⤵
        
        PID:4912
      - C:\Windows\apppatch\de-DE\backup.exe
        
        C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
        6⤵
        
        PID:4772
      - C:\Windows\apppatch\CustomSDB\backup.exe
        
        C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
        6⤵
        
        PID:3800
      - C:\Windows\apppatch\en-US\backup.exe
        
        C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
        6⤵
        
        PID:4852
      - C:\Windows\apppatch\es-ES\backup.exe
        
        C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
        6⤵
        
        PID:2220
      - C:\Windows\apppatch\fr-FR\data.exe
        
        C:\Windows\apppatch\fr-FR\data.exe C:\Windows\apppatch\fr-FR\
        6⤵
        
        PID:2488
      - C:\Windows\apppatch\it-IT\backup.exe
        
        C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
        6⤵
        
        PID:1188
        
        C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe
        
        C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\
        7⤵
        
        PID:4692
        
        C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\update.exe
        
        C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:1756
        
        C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
        
        C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\
        9⤵
        
        PID:5312
    - - C:\Windows\addins\backup.exe
        
        C:\Windows\addins\backup.exe C:\Windows\addins\
        5⤵
        
        PID:2928
    - - C:\Windows\AppReadiness\backup.exe
        
        C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
        5⤵
        
        PID:4076
      - C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
        6⤵
        
        PID:2752
    - - C:\Windows\assembly\backup.exe
        
        C:\Windows\assembly\backup.exe C:\Windows\assembly\
        5⤵
        
        PID:3992
      - C:\Windows\assembly\GAC\backup.exe
        
        C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
        6⤵
        
        PID:3228
        
        C:\Windows\assembly\GAC\Extensibility\backup.exe
        
        C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
        7⤵
        
        PID:4136
        
        C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe
        
        C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\
        7⤵
        
        PID:812
        
        C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:1584
        
        C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe
        
        C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\
        7⤵
        
        PID:3756
        
        C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:1632
        
        C:\Windows\assembly\GAC\MSDATASRC\backup.exe
        
        C:\Windows\assembly\GAC\MSDATASRC\backup.exe C:\Windows\assembly\GAC\MSDATASRC\
        7⤵
        
        PID:544
        
        C:\Windows\assembly\GAC\stdole\System Restore.exe
        
        "C:\Windows\assembly\GAC\stdole\System Restore.exe" C:\Windows\assembly\GAC\stdole\
        7⤵
        
        PID:5160
      - C:\Windows\assembly\GAC_32\backup.exe
        
        C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\
        6⤵
        
        PID:1188
        
        C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe
        
        C:\Windows\assembly\GAC_32\ISymWrapper\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\
        7⤵
        
        PID:1336
        
        C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:5524
        
        C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe
        
        C:\Windows\assembly\GAC_32\Microsoft.Ink\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\
        7⤵
        
        PID:4332
        
        C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\
        8⤵
        
        PID:1112
        
        C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe
        
        C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\
        7⤵
        
        PID:4356
        
        C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
        8⤵
        
        PID:5636
        
        C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe
        
        C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\
        7⤵
        
        PID:4200
        
        C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:4332
        
        C:\Windows\assembly\GAC_32\MSBuild\backup.exe
        
        C:\Windows\assembly\GAC_32\MSBuild\backup.exe C:\Windows\assembly\GAC_32\MSBuild\
        7⤵
        
        PID:6104
        
        C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:4140
        
        C:\Windows\assembly\GAC_32\mscorlib\backup.exe
        
        C:\Windows\assembly\GAC_32\mscorlib\backup.exe C:\Windows\assembly\GAC_32\mscorlib\
        7⤵
        
        PID:5844
        
        C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
        
        C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\
        8⤵
        
        PID:5548
        
        C:\Windows\assembly\GAC_32\PresentationCore\backup.exe
        
        C:\Windows\assembly\GAC_32\PresentationCore\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\
        7⤵
        
        PID:2980
        
        C:\Windows\assembly\GAC_32\System.Data\update.exe
        
        C:\Windows\assembly\GAC_32\System.Data\update.exe C:\Windows\assembly\GAC_32\System.Data\
        7⤵
        
        PID:948
        
        C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
        
        C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\
        8⤵
        
        PID:4304
      - C:\Windows\assembly\GAC_64\backup.exe
        
        C:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\
        6⤵
        
        PID:4620
        
        C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe
        
        C:\Windows\assembly\GAC_64\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\
        7⤵
        
        PID:3040
        
        C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:5696
        
        C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe
        
        C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\
        7⤵
        
        PID:5496
      - C:\Windows\assembly\GAC_MSIL\backup.exe
        
        C:\Windows\assembly\GAC_MSIL\backup.exe C:\Windows\assembly\GAC_MSIL\
        6⤵
        
        PID:528
      - C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\
        6⤵
        
        PID:3308
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\
        7⤵
        
        PID:5240
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\
        8⤵
        
        PID:3736
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\0db851c73d11018ad4b5a4d0d4be2e36\
        8⤵
        
        PID:3676
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\update.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\
        8⤵
        
        PID:5872
    - - C:\Windows\bcastdvr\backup.exe
        
        C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\
        5⤵
        
        PID:3828
    - - C:\Windows\Branding\backup.exe
        
        C:\Windows\Branding\backup.exe C:\Windows\Branding\
        5⤵
        
        PID:4972
      - C:\Windows\Branding\Basebrd\backup.exe
        
        C:\Windows\Branding\Basebrd\backup.exe C:\Windows\Branding\Basebrd\
        6⤵
        
        PID:4104
        
        C:\Windows\Branding\Basebrd\en-US\backup.exe
        
        C:\Windows\Branding\Basebrd\en-US\backup.exe C:\Windows\Branding\Basebrd\en-US\
        7⤵
        
        PID:1164
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\
        8⤵
        
        PID:5536
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\System Restore.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\
        9⤵
        
        PID:2028
        
        C:\Windows\Branding\Basebrd\fr-FR\backup.exe
        
        C:\Windows\Branding\Basebrd\fr-FR\backup.exe C:\Windows\Branding\Basebrd\fr-FR\
        7⤵
        
        PID:2968
        
        C:\Windows\Branding\Basebrd\it-IT\backup.exe
        
        C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\
        7⤵
        
        PID:3552
    - - C:\Windows\Cursors\backup.exe
        
        C:\Windows\Cursors\backup.exe C:\Windows\Cursors\
        5⤵
        
        PID:5420
    - - C:\Windows\debug\backup.exe
        
        C:\Windows\debug\backup.exe C:\Windows\debug\
        5⤵
        
        PID:5156
    - - C:\Windows\DigitalLocker\backup.exe
        
        C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\
        5⤵
        
        PID:1028
      - C:\Windows\DigitalLocker\en-US\backup.exe
        
        C:\Windows\DigitalLocker\en-US\backup.exe C:\Windows\DigitalLocker\en-US\
        6⤵
        
        PID:3696
    - - C:\Windows\en-US\backup.exe
        
        C:\Windows\en-US\backup.exe C:\Windows\en-US\
        5⤵
        
        PID:1248
    - - C:\Windows\fr-FR\backup.exe
        
        C:\Windows\fr-FR\backup.exe C:\Windows\fr-FR\
        5⤵
        
        PID:5380
    - - C:\Windows\GameBarPresenceWriter\backup.exe
        
        C:\Windows\GameBarPresenceWriter\backup.exe C:\Windows\GameBarPresenceWriter\
        5⤵
        
        PID:1160
    - - C:\Windows\Globalization\backup.exe
        
        C:\Windows\Globalization\backup.exe C:\Windows\Globalization\
        5⤵
        
        PID:3760
      - C:\Windows\Globalization\ELS\backup.exe
        
        C:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\
        6⤵
        
        PID:5892
- C:\Users\Admin\AppData\Local\Temp\2894544766\backup.exe
  C:\Users\Admin\AppData\Local\Temp\2894544766\backup.exe C:\Users\Admin\AppData\Local\Temp\2894544766\
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\acrocef_low\System Restore.exe
  "C:\Users\Admin\AppData\Local\Temp\acrocef_low\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\acrocef_low\
  2⤵
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  PID:3912
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  PID:400
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\backup.exe
  C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\
  2⤵
  PID:4504
- - C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\CRX_INSTALL\backup.exe
    C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\CRX_INSTALL\
    3⤵
    PID:3784
- C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\backup.exe
  C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\
  2⤵
  PID:4204
- C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
  C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\
  2⤵
  PID:4780

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
  C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\
  2⤵
  PID:4348

C:\Program Files\Common Files\microsoft shared\backup.exe
"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
1⤵
PID:2300
- C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
  2⤵
  PID:3408
- C:\Program Files\Common Files\microsoft shared\ink\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
  2⤵
  PID:3272
- - C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
    3⤵
    PID:4700
- - C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
    3⤵
    PID:4328
- - C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
    3⤵
    PID:3308
- - C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
    3⤵
    PID:2028
- - C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
    3⤵
    PID:1496
- - C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
    3⤵
    PID:1260
- - C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
    3⤵
    PID:724
- - C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
    3⤵
    PID:872
- - C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
    3⤵
    PID:4692
- - C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
    3⤵
    PID:3228
  - - C:\Windows\assembly\GAC\ADODB\backup.exe
      C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
      4⤵
      PID:4076
- - C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
    3⤵
    PID:2748
- - C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
    3⤵
    PID:1164
- - C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
    3⤵
    PID:4348
- - C:\Program Files\Common Files\microsoft shared\ink\fr-FR\System Restore.exe
    "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
    3⤵
    PID:4780
- - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
    3⤵
    PID:1528
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
      4⤵
      PID:208
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
      4⤵
      PID:1112
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
      4⤵
      PID:4404
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\
        5⤵
        
        PID:1136
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\
        5⤵
        
        PID:4700
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\
        5⤵
        
        PID:6072
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\
        5⤵
        
        PID:2100
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\
        5⤵
        
        PID:548
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\
        5⤵
        
        PID:4028
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
      4⤵
      PID:4428
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
      4⤵
      PID:4748
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
      4⤵
      PID:3968
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
      4⤵
      PID:2684
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
      4⤵
      PID:4220
  - - C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
      4⤵
      PID:1500
- - C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
    3⤵
    PID:2492
- - C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
    3⤵
    PID:820
- - C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
    3⤵
    PID:2488
- - C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\System Restore.exe
    "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
    3⤵
    PID:5016
- - C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
    3⤵
    PID:4816
- - C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
    3⤵
    PID:1496
- - C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
    3⤵
    PID:216
- - C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
    3⤵
    PID:4780
- - C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
    3⤵
    PID:2492
- - C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
    3⤵
    PID:3580
- - C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
    3⤵
    PID:2196
- - C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
    3⤵
    PID:4216
- - C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
    3⤵
    PID:4296
- - C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
    3⤵
    PID:4076
- - C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
    3⤵
    PID:3928
- - C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
    3⤵
    PID:2148
- - C:\Program Files\Common Files\microsoft shared\ink\sk-SK\update.exe
    "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\update.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
    3⤵
    PID:1668
- - C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
    3⤵
    PID:4260
- - C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
    3⤵
    PID:3796
- - C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
    3⤵
    PID:4756
- - C:\Program Files\Common Files\microsoft shared\ink\ro-RO\data.exe
    "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\data.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
    3⤵
    PID:4376
- - C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
    3⤵
    PID:652
- - C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
    3⤵
    PID:2864
- - C:\Program Files\Common Files\microsoft shared\ink\zh-CN\System Restore.exe
    "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
    3⤵
    PID:5000
- - C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe
    "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
    3⤵
    PID:3780
- - C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
    "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
    3⤵
    PID:3920
- C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
  2⤵
  PID:1612
- - C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
    "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
    3⤵
    PID:4304
- - C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
    "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
    3⤵
    PID:3928
- - C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
    "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
    3⤵
    PID:4764
- - C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
    "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
    3⤵
    PID:208
- - C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
    "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
    3⤵
    PID:4324
- - C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
    "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
    3⤵
    PID:1240
- C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
  "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
  2⤵
  PID:5028
- - C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
    "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
    3⤵
    PID:2360
- C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
  "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
  2⤵
  PID:2980
- - C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
    "C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
    3⤵
    PID:1140
- C:\Program Files\Common Files\microsoft shared\Source Engine\data.exe
  "C:\Program Files\Common Files\microsoft shared\Source Engine\data.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
  2⤵
  PID:3104
- C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
  "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
  2⤵
  PID:4092
- - C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
    "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
    3⤵
    PID:2200
- C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
  "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
  2⤵
  PID:5016
- - C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
    "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
    3⤵
    PID:3580
- C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
  "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
  2⤵
  PID:4828
- C:\Program Files\Common Files\microsoft shared\VC\backup.exe
  "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
  2⤵
  PID:3988
- C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
  "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
  2⤵
  PID:4324
- C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
  "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
  2⤵
  PID:1644

C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\CRX_INSTALL\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\CRX_INSTALL\
1⤵
PID:4472

C:\Program Files\Common Files\DESIGNER\backup.exe
"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
1⤵
PID:3900

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
1⤵
PID:3648

C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
1⤵
PID:4816

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\data.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\data.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
1⤵
PID:1756

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
1⤵
PID:1112

C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
1⤵
PID:2752

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
1⤵
PID:492

C:\Program Files\Java\jdk-1.8\bin\backup.exe
"C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\
1⤵
PID:5016

C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\update.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
1⤵
PID:2904

C:\Program Files (x86)\Google\Update\Download\backup.exe
"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
1⤵
PID:4772
- C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
  2⤵
  PID:4876

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
1⤵
PID:2688
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
  2⤵
  PID:4268
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\
  2⤵
  PID:1736
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\
  2⤵
  PID:4216
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\
  2⤵
  PID:1240
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
  2⤵
  PID:1188
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
  2⤵
  PID:4084
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
  2⤵
  PID:4204
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
    3⤵
    PID:2876

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
1⤵
PID:4456

C:\Program Files\Java\jdk-1.8\backup.exe
"C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\
1⤵
PID:4468
- C:\Program Files\Java\jdk-1.8\include\backup.exe
  "C:\Program Files\Java\jdk-1.8\include\backup.exe" C:\Program Files\Java\jdk-1.8\include\
  2⤵
  PID:5096
- C:\Program Files\Java\jdk-1.8\jre\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\backup.exe" C:\Program Files\Java\jdk-1.8\jre\
  2⤵
  PID:2336
- - C:\Program Files\Java\jdk-1.8\jre\legal\update.exe
    "C:\Program Files\Java\jdk-1.8\jre\legal\update.exe" C:\Program Files\Java\jdk-1.8\jre\legal\
    3⤵
    PID:2292
  - - C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\jdk\
      4⤵
      PID:1632
  - - C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\javafx\
      4⤵
      PID:4888
- - C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe
    "C:\Program Files\Java\jdk-1.8\jre\lib\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\
    3⤵
    PID:2188
  - - C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\
      4⤵
      PID:524
  - - C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\applet\
      4⤵
      PID:2232
  - - C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\
      4⤵
      PID:2072
  - - C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\fonts\
      4⤵
      PID:2176
  - - C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\ext\
      4⤵
      PID:2696
  - - C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\jfr\
      4⤵
      PID:5744
  - - C:\Program Files\Java\jdk-1.8\jre\lib\security\data.exe
      "C:\Program Files\Java\jdk-1.8\jre\lib\security\data.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\
      4⤵
      PID:5452
    - - C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\
        5⤵
        
        PID:2724
      - C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\
        6⤵
        
        PID:4500
    - - C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\
        5⤵
        
        PID:1492
- C:\Program Files\Java\jdk-1.8\lib\backup.exe
  "C:\Program Files\Java\jdk-1.8\lib\backup.exe" C:\Program Files\Java\jdk-1.8\lib\
  2⤵
  PID:1568
- C:\Program Files\Java\jdk-1.8\legal\backup.exe
  "C:\Program Files\Java\jdk-1.8\legal\backup.exe" C:\Program Files\Java\jdk-1.8\legal\
  2⤵
  PID:1652
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\
  2⤵
  PID:4476
- C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\backup.exe
  C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\
  2⤵
  PID:5792

C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
1⤵
PID:4308

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
1⤵
PID:1036

C:\Program Files\Microsoft Office\Office16\backup.exe
"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
1⤵
PID:2364

C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe
"C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\
1⤵
PID:2520

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
1⤵
PID:2156
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
  2⤵
  PID:4068
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
    3⤵
    PID:4048
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
  2⤵
  PID:4972
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
  2⤵
  PID:1492

C:\Program Files\Microsoft Office\PackageManifests\backup.exe
"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
1⤵
PID:3580

C:\Program Files\Java\jre-1.8\bin\backup.exe
"C:\Program Files\Java\jre-1.8\bin\backup.exe" C:\Program Files\Java\jre-1.8\bin\
1⤵
PID:1016
- C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\
  2⤵
  PID:1668
- C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe
  "C:\Program Files\Java\jre-1.8\bin\plugin2\backup.exe" C:\Program Files\Java\jre-1.8\bin\plugin2\
  2⤵
  PID:2340
- - C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:2864
- C:\Program Files\Java\jre-1.8\bin\server\backup.exe
  "C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\
  2⤵
  PID:4412

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\
1⤵
PID:2100
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\
  2⤵
  PID:4608
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\
  2⤵
  PID:1196
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\backup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\
  2⤵
  PID:2564

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
1⤵
PID:4544
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
  2⤵
  PID:3696
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
    3⤵
    PID:3256
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\
    3⤵
    PID:4968
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\
      4⤵
      PID:2016
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\
        5⤵
        
        PID:4308
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\
        5⤵
        
        PID:2404
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\
    3⤵
    PID:4656
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\
      4⤵
      PID:3772
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\
  2⤵
  PID:948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\data.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\
    3⤵
    PID:1340
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\
      4⤵
      PID:4804
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\
    3⤵
    PID:4272
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\
  2⤵
  PID:4268
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\
    3⤵
    PID:4656
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\
    3⤵
    PID:4232

C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
"C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
1⤵
PID:2008
- C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
  2⤵
  PID:3392
- C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
  2⤵
  PID:680
- C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
  2⤵
  PID:1756

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe
"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\backup.exe" C:\Program Files (x86)\Common Files\Oracle\Java\javapath\
1⤵
PID:2488

C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\
1⤵
PID:4916

C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\bin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\
1⤵
PID:496
- C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\
  2⤵
  PID:4172
- - C:\Program Files\Common Files\System\en-US\backup.exe
    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
    3⤵
    PID:1968
- C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\server\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\server\
  2⤵
  PID:4492

C:\Program Files\Microsoft Office\root\Client\System Restore.exe
"C:\Program Files\Microsoft Office\root\Client\System Restore.exe" C:\Program Files\Microsoft Office\root\Client\
1⤵
PID:2744

C:\Program Files (x86)\Common Files\Oracle\Java\System Restore.exe
"C:\Program Files (x86)\Common Files\Oracle\Java\System Restore.exe" C:\Program Files (x86)\Common Files\Oracle\Java\
1⤵
PID:3044

C:\Program Files\Microsoft Office\root\backup.exe
"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
1⤵
PID:3076
- C:\Program Files\Microsoft Office\root\fre\backup.exe
  "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
  2⤵
  PID:3472
- C:\Program Files\Microsoft Office\root\Licenses\backup.exe
  "C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\
  2⤵
  PID:2764
- C:\Program Files\Microsoft Office\root\Integration\backup.exe
  "C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\
  2⤵
  PID:2980
- C:\Program Files\Microsoft Office\root\Licenses16\backup.exe
  "C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\
  2⤵
  PID:4628
- C:\Program Files\Microsoft Office\root\loc\backup.exe
  "C:\Program Files\Microsoft Office\root\loc\backup.exe" C:\Program Files\Microsoft Office\root\loc\
  2⤵
  PID:208
- C:\Program Files\Microsoft Office\root\Office15\backup.exe
  "C:\Program Files\Microsoft Office\root\Office15\backup.exe" C:\Program Files\Microsoft Office\root\Office15\
  2⤵
  PID:2492
- C:\Program Files\Microsoft Office\root\Office16\data.exe
  "C:\Program Files\Microsoft Office\root\Office16\data.exe" C:\Program Files\Microsoft Office\root\Office16\
  2⤵
  PID:2160
- - C:\Program Files\Microsoft Office\root\Office16\1036\update.exe
    "C:\Program Files\Microsoft Office\root\Office16\1036\update.exe" C:\Program Files\Microsoft Office\root\Office16\1036\
    3⤵
    PID:4200
- - C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\AugLoop\backup.exe" C:\Program Files\Microsoft Office\root\Office16\AugLoop\
    3⤵
    PID:2404
- - C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\BORDERS\
    3⤵
    PID:4008
- - C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\FPA_f14\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f14\
    3⤵
    PID:2064
- C:\Program Files\Microsoft Office\root\rsod\backup.exe
  "C:\Program Files\Microsoft Office\root\rsod\backup.exe" C:\Program Files\Microsoft Office\root\rsod\
  2⤵
  PID:3912
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\
    3⤵
    PID:5756
- C:\Program Files\Microsoft Office\root\Templates\backup.exe
  "C:\Program Files\Microsoft Office\root\Templates\backup.exe" C:\Program Files\Microsoft Office\root\Templates\
  2⤵
  PID:6140
- - C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe
    "C:\Program Files\Microsoft Office\root\Templates\1033\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\
    3⤵
    PID:5616
  - - C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe
      "C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\
      4⤵
      PID:2864
- - C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe
    "C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe" C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\
    3⤵
    PID:6020

C:\Program Files\Mozilla Firefox\browser\features\backup.exe
"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
1⤵
PID:1016

C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\
1⤵
PID:1392

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\
1⤵
PID:4844
- C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
  "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
  2⤵
  PID:5624
- C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
  "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
  2⤵
  PID:2736

C:\Program Files\Mozilla Firefox\browser\backup.exe
"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
1⤵
PID:2092
- C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
  2⤵
  PID:932

C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe
"C:\Program Files\Java\jdk-1.8\legal\jdk\backup.exe" C:\Program Files\Java\jdk-1.8\legal\jdk\
1⤵
PID:1612

C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe
"C:\Program Files\Java\jdk-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jdk-1.8\legal\javafx\
1⤵
PID:2696

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\data.exe
C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:3772
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\
  2⤵
  PID:4212
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\
  2⤵
  PID:2108

C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\logs\
1⤵
PID:2092

C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\
1⤵
PID:400

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:5300
- C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\
  2⤵
  PID:812

C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\
1⤵
PID:5728

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\
1⤵
PID:2540

C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\
1⤵
PID:2924

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\vfs\Windows\assembly\GAC_MSIL\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\vfs\Windows\assembly\GAC_MSIL\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\vfs\Windows\assembly\GAC_MSIL\
1⤵
PID:6000
- C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe
  "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\2F83BD1D-C37E-49A4-8DFF-CE9E760C8D51\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\
  2⤵
  PID:5300

C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:5980

C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\en-US\
1⤵
PID:6044

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:5628

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:2764

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\
1⤵
PID:4180

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\
1⤵
PID:6116

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
1⤵
PID:1092

C:\Program Files\VideoLAN\VLC\locale\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
1⤵
PID:5180
- C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
  2⤵
  PID:5264
- - C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
    3⤵
    PID:3040
- C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
  2⤵
  PID:6136
- C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
  2⤵
  PID:5456
- C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
  2⤵
  PID:5908
- - C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
    3⤵
    PID:5748

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:336
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
  2⤵
  PID:4188
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
  2⤵
  PID:5368
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
  2⤵
  PID:1660
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
  2⤵
  PID:1584

C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:5516

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\
1⤵
PID:2772

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:4540

C:\Windows\DiagTrack\Settings\backup.exe
C:\Windows\DiagTrack\Settings\backup.exe C:\Windows\DiagTrack\Settings\
1⤵
PID:2924

C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Common AppData\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\
1⤵
PID:4764
- C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\
  2⤵
  PID:5540

C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe
"C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\limited\
1⤵
PID:3712
- C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe
  "C:\Program Files (x86)\Windows Media Player\de-DE\backup.exe" C:\Program Files (x86)\Windows Media Player\de-DE\
  2⤵
  PID:3888
- C:\Program Files (x86)\Windows Media Player\en-US\backup.exe
  "C:\Program Files (x86)\Windows Media Player\en-US\backup.exe" C:\Program Files (x86)\Windows Media Player\en-US\
  2⤵
  PID:3788

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
1⤵
PID:4516

C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\
1⤵
PID:4180

C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1320

C:\Program Files\Windows Defender\de-DE\backup.exe
"C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
1⤵
PID:3008

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\
1⤵
PID:5408

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
1⤵
PID:5056

C:\Program Files\VideoLAN\VLC\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
1⤵
PID:3112
- C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
  2⤵
  PID:4640

C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\
1⤵
PID:5460

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
1⤵
PID:5588

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\
1⤵
PID:5528

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\
1⤵
PID:4192

C:\Program Files\Windows Defender\it-IT\backup.exe
"C:\Program Files\Windows Defender\it-IT\backup.exe" C:\Program Files\Windows Defender\it-IT\
1⤵
PID:4240

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\
1⤵
PID:5748

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\
1⤵
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\
1⤵
PID:1144

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
1⤵
PID:2188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\
1⤵
PID:1148

C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access_output\
1⤵
PID:1428

C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
1⤵
PID:1612

C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:1632

C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\
1⤵
PID:560

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\
1⤵
PID:4888

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\
1⤵
PID:5124

C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\
1⤵
PID:4080

C:\Program Files (x86)\Windows NT\TableTextService\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\
1⤵
PID:6096
- C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe
  "C:\Program Files (x86)\Windows NT\TableTextService\en-US\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\en-US\
  2⤵
  PID:5304

C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:5516

C:\Program Files\VideoLAN\VLC\skins\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
1⤵
PID:4716

C:\Program Files\Windows NT\Accessories\backup.exe
"C:\Program Files\Windows NT\Accessories\backup.exe" C:\Program Files\Windows NT\Accessories\
1⤵
PID:4048

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\
1⤵
PID:1028

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\data.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\
1⤵
PID:556

C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe
C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_64\System.Data\2.0.0.0__b77a5c561934e089\
1⤵
PID:1976

C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\
1⤵
PID:1472

C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\
1⤵
PID:3136

C:\Program Files\Windows Media Player\it-IT\backup.exe
"C:\Program Files\Windows Media Player\it-IT\backup.exe" C:\Program Files\Windows Media Player\it-IT\
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
338KB

MD5
a95c8349e045e6730aacc53eb80cf00b

SHA1
c0c2776c51a0459121ed2d69b06c60f5b8a0510d

SHA256
f155f3c3ff449c133c28a7c403f412df4a28008272995eefae9c3a9ac0c46c54

SHA512
67cd54e80d4185073240f671d08ca33fe180ac0d1c9ecd1810d0d856da46c4dfd270524179a75aed31ffc55177536d49ed5b1755d8514de45e60a7e1fe95f80e

Download Submit
C:\PerfLogs\backup.exe

Filesize
338KB

MD5
a95c8349e045e6730aacc53eb80cf00b

SHA1
c0c2776c51a0459121ed2d69b06c60f5b8a0510d

SHA256
f155f3c3ff449c133c28a7c403f412df4a28008272995eefae9c3a9ac0c46c54

SHA512
67cd54e80d4185073240f671d08ca33fe180ac0d1c9ecd1810d0d856da46c4dfd270524179a75aed31ffc55177536d49ed5b1755d8514de45e60a7e1fe95f80e

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
338KB

MD5
8c86139c4731d41917834584c770b4a9

SHA1
590c72a620a2a0079ed35dfc597dc11b48c0e133

SHA256
78d6fb82c479fa63ec46e0cca3040c2e011470c073bf4ed9e3dc67033ad27606

SHA512
7c3513b2bf11458eff8904ba7126aea570a90af6ba4f2e325a47609475e56f6d6d623dd1aac046b9b9d30070267e2b8ca87fb80dbc0ea1abedc82bf88a4ba371

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
338KB

MD5
8c86139c4731d41917834584c770b4a9

SHA1
590c72a620a2a0079ed35dfc597dc11b48c0e133

SHA256
78d6fb82c479fa63ec46e0cca3040c2e011470c073bf4ed9e3dc67033ad27606

SHA512
7c3513b2bf11458eff8904ba7126aea570a90af6ba4f2e325a47609475e56f6d6d623dd1aac046b9b9d30070267e2b8ca87fb80dbc0ea1abedc82bf88a4ba371

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
338KB

MD5
6d9f623c2806e96a885bcdafcdd7fd0a

SHA1
38eee6c16f0cfcfacc2c25bd2b611cfbdd1d39c4

SHA256
36153d5a3530b628bd567d0f5559a9157454779d8c48346ddee2ea830e06ffac

SHA512
f546e1041101c599356cf7d6d632ca9815d212b90690c27dd0cb4e061f394fc337275cdfcbf1bf67d52c18bb5bc6ee105cd51849d08f8abafea13ada8bed9cd6

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
338KB

MD5
6d9f623c2806e96a885bcdafcdd7fd0a

SHA1
38eee6c16f0cfcfacc2c25bd2b611cfbdd1d39c4

SHA256
36153d5a3530b628bd567d0f5559a9157454779d8c48346ddee2ea830e06ffac

SHA512
f546e1041101c599356cf7d6d632ca9815d212b90690c27dd0cb4e061f394fc337275cdfcbf1bf67d52c18bb5bc6ee105cd51849d08f8abafea13ada8bed9cd6

Download Submit
C:\Program Files\Common Files\DESIGNER\backup.exe

Filesize
338KB

MD5
d87e8f9e8e9055315e5103586a14591b

SHA1
4f248f7c88db17f059fb149c297af47358dc24dc

SHA256
c276030efa063a62fbbe28ad961d9fbb63dc6bb1ee386641ddf0a985e0c2dec9

SHA512
7a35e8aac2cb89f3976b5a4bc131a80055081622fba561f8d9f0423ae58d30a27390b5c9b01f4cc993818b1b1c620854068d30d708c7eabd6e43fcaa7d877ed3

Download Submit
C:\Program Files\Common Files\DESIGNER\backup.exe

Filesize
338KB

MD5
d87e8f9e8e9055315e5103586a14591b

SHA1
4f248f7c88db17f059fb149c297af47358dc24dc

SHA256
c276030efa063a62fbbe28ad961d9fbb63dc6bb1ee386641ddf0a985e0c2dec9

SHA512
7a35e8aac2cb89f3976b5a4bc131a80055081622fba561f8d9f0423ae58d30a27390b5c9b01f4cc993818b1b1c620854068d30d708c7eabd6e43fcaa7d877ed3

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
338KB

MD5
cf639780beb9134d55c1d7f48d8a7589

SHA1
125dcc7fa5374cb9738e2c6f1e7a531b02ddf4a9

SHA256
50f936098465c90f624a50a9e61b1bf9620830d543eb669fd464a6e431fa5bdc

SHA512
b40a517e0a3fcdf1fc8895fe4afac1af52719cec0dd915d936b3d2f02da0708e014bf16cda1e087a4496732c7b6fdbef4b3213b8c16fe00a00b239e0ad212f5e

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
338KB

MD5
cf639780beb9134d55c1d7f48d8a7589

SHA1
125dcc7fa5374cb9738e2c6f1e7a531b02ddf4a9

SHA256
50f936098465c90f624a50a9e61b1bf9620830d543eb669fd464a6e431fa5bdc

SHA512
b40a517e0a3fcdf1fc8895fe4afac1af52719cec0dd915d936b3d2f02da0708e014bf16cda1e087a4496732c7b6fdbef4b3213b8c16fe00a00b239e0ad212f5e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

Filesize
338KB

MD5
9d3682f1af21a994780f00cc08dfe596

SHA1
49f6241ff98774eb7a6945f9f5db02c2ce372ab1

SHA256
cfe6389814ccc69e19af52677082808611675dd346e3833bdf3612cd5d80f570

SHA512
b35648cb6d57f65efc52663e2360722dcee486550dc96957cb13a3afa19b8f036e3f2a96b09746460b9bb912a27a6b765724b31cb6df364dfbce1f1996d564b8

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

Filesize
338KB

MD5
9d3682f1af21a994780f00cc08dfe596

SHA1
49f6241ff98774eb7a6945f9f5db02c2ce372ab1

SHA256
cfe6389814ccc69e19af52677082808611675dd346e3833bdf3612cd5d80f570

SHA512
b35648cb6d57f65efc52663e2360722dcee486550dc96957cb13a3afa19b8f036e3f2a96b09746460b9bb912a27a6b765724b31cb6df364dfbce1f1996d564b8

Download Submit
C:\Program Files\Common Files\microsoft shared\backup.exe

Filesize
338KB

MD5
d87e8f9e8e9055315e5103586a14591b

SHA1
4f248f7c88db17f059fb149c297af47358dc24dc

SHA256
c276030efa063a62fbbe28ad961d9fbb63dc6bb1ee386641ddf0a985e0c2dec9

SHA512
7a35e8aac2cb89f3976b5a4bc131a80055081622fba561f8d9f0423ae58d30a27390b5c9b01f4cc993818b1b1c620854068d30d708c7eabd6e43fcaa7d877ed3

Download Submit
C:\Program Files\Common Files\microsoft shared\backup.exe

Filesize
338KB

MD5
d87e8f9e8e9055315e5103586a14591b

SHA1
4f248f7c88db17f059fb149c297af47358dc24dc

SHA256
c276030efa063a62fbbe28ad961d9fbb63dc6bb1ee386641ddf0a985e0c2dec9

SHA512
7a35e8aac2cb89f3976b5a4bc131a80055081622fba561f8d9f0423ae58d30a27390b5c9b01f4cc993818b1b1c620854068d30d708c7eabd6e43fcaa7d877ed3

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

Filesize
338KB

MD5
5ec84712402afb684d0e6ce5864774a5

SHA1
4451b5d2f4d56187d40e5ab96a34a0ed2ec616cf

SHA256
095065b7c829a9afa049747bf35ab9f9be7db168f61642377cf16bca996fe5d7

SHA512
2d31c06dd9842889e1f7c84a7b42a255668c468bbba85e80e4c485ccfa8928b82908298d05d515758e88c4a5d357c75b2fab7bf86988c646b4316c503a5d6898

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

Filesize
338KB

MD5
5ec84712402afb684d0e6ce5864774a5

SHA1
4451b5d2f4d56187d40e5ab96a34a0ed2ec616cf

SHA256
095065b7c829a9afa049747bf35ab9f9be7db168f61642377cf16bca996fe5d7

SHA512
2d31c06dd9842889e1f7c84a7b42a255668c468bbba85e80e4c485ccfa8928b82908298d05d515758e88c4a5d357c75b2fab7bf86988c646b4316c503a5d6898

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\backup.exe

Filesize
338KB

MD5
9d3682f1af21a994780f00cc08dfe596

SHA1
49f6241ff98774eb7a6945f9f5db02c2ce372ab1

SHA256
cfe6389814ccc69e19af52677082808611675dd346e3833bdf3612cd5d80f570

SHA512
b35648cb6d57f65efc52663e2360722dcee486550dc96957cb13a3afa19b8f036e3f2a96b09746460b9bb912a27a6b765724b31cb6df364dfbce1f1996d564b8

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\backup.exe

Filesize
338KB

MD5
9d3682f1af21a994780f00cc08dfe596

SHA1
49f6241ff98774eb7a6945f9f5db02c2ce372ab1

SHA256
cfe6389814ccc69e19af52677082808611675dd346e3833bdf3612cd5d80f570

SHA512
b35648cb6d57f65efc52663e2360722dcee486550dc96957cb13a3afa19b8f036e3f2a96b09746460b9bb912a27a6b765724b31cb6df364dfbce1f1996d564b8

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

Filesize
338KB

MD5
5ec84712402afb684d0e6ce5864774a5

SHA1
4451b5d2f4d56187d40e5ab96a34a0ed2ec616cf

SHA256
095065b7c829a9afa049747bf35ab9f9be7db168f61642377cf16bca996fe5d7

SHA512
2d31c06dd9842889e1f7c84a7b42a255668c468bbba85e80e4c485ccfa8928b82908298d05d515758e88c4a5d357c75b2fab7bf86988c646b4316c503a5d6898

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

Filesize
338KB

MD5
5ec84712402afb684d0e6ce5864774a5

SHA1
4451b5d2f4d56187d40e5ab96a34a0ed2ec616cf

SHA256
095065b7c829a9afa049747bf35ab9f9be7db168f61642377cf16bca996fe5d7

SHA512
2d31c06dd9842889e1f7c84a7b42a255668c468bbba85e80e4c485ccfa8928b82908298d05d515758e88c4a5d357c75b2fab7bf86988c646b4316c503a5d6898

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

Filesize
338KB

MD5
120f089bfabed5d960a2f35603560e0e

SHA1
ec29a489976b4a634b7acbf80024510bd7c1ca03

SHA256
de60860b7be5440cefb790b80e0cc841aacc7a9254e827d9f73efef288d15029

SHA512
0d5b6d6b8e960de0d6dcf7f07e7322f7c9da5ca4be2c31c3186bfc8f3b27d50faa5d74afa1db719179c8f80d1977da5619fd8f264758d4a83e4c4f142516be0e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

Filesize
338KB

MD5
120f089bfabed5d960a2f35603560e0e

SHA1
ec29a489976b4a634b7acbf80024510bd7c1ca03

SHA256
de60860b7be5440cefb790b80e0cc841aacc7a9254e827d9f73efef288d15029

SHA512
0d5b6d6b8e960de0d6dcf7f07e7322f7c9da5ca4be2c31c3186bfc8f3b27d50faa5d74afa1db719179c8f80d1977da5619fd8f264758d4a83e4c4f142516be0e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

Filesize
338KB

MD5
120f089bfabed5d960a2f35603560e0e

SHA1
ec29a489976b4a634b7acbf80024510bd7c1ca03

SHA256
de60860b7be5440cefb790b80e0cc841aacc7a9254e827d9f73efef288d15029

SHA512
0d5b6d6b8e960de0d6dcf7f07e7322f7c9da5ca4be2c31c3186bfc8f3b27d50faa5d74afa1db719179c8f80d1977da5619fd8f264758d4a83e4c4f142516be0e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

Filesize
338KB

MD5
120f089bfabed5d960a2f35603560e0e

SHA1
ec29a489976b4a634b7acbf80024510bd7c1ca03

SHA256
de60860b7be5440cefb790b80e0cc841aacc7a9254e827d9f73efef288d15029

SHA512
0d5b6d6b8e960de0d6dcf7f07e7322f7c9da5ca4be2c31c3186bfc8f3b27d50faa5d74afa1db719179c8f80d1977da5619fd8f264758d4a83e4c4f142516be0e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

Filesize
338KB

MD5
ceabc16998c168297a0cb74385534616

SHA1
801c25c3abc4e508bfc6686b9698bf6208bf8032

SHA256
6723f61f1d556f5ee79eb58e71f11281b8ea13083d3080283a41cc0a83dab311

SHA512
c0f34dab5f5176ea94752c9b081888eaa7574dfb5103dd963076f6d368add411e4ce1961954a3175d553e3c3d3368b7ef1918fe664f6b00ccab24b754ff380d4

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

Filesize
338KB

MD5
ceabc16998c168297a0cb74385534616

SHA1
801c25c3abc4e508bfc6686b9698bf6208bf8032

SHA256
6723f61f1d556f5ee79eb58e71f11281b8ea13083d3080283a41cc0a83dab311

SHA512
c0f34dab5f5176ea94752c9b081888eaa7574dfb5103dd963076f6d368add411e4ce1961954a3175d553e3c3d3368b7ef1918fe664f6b00ccab24b754ff380d4

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

Filesize
338KB

MD5
ceabc16998c168297a0cb74385534616

SHA1
801c25c3abc4e508bfc6686b9698bf6208bf8032

SHA256
6723f61f1d556f5ee79eb58e71f11281b8ea13083d3080283a41cc0a83dab311

SHA512
c0f34dab5f5176ea94752c9b081888eaa7574dfb5103dd963076f6d368add411e4ce1961954a3175d553e3c3d3368b7ef1918fe664f6b00ccab24b754ff380d4

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

Filesize
338KB

MD5
ceabc16998c168297a0cb74385534616

SHA1
801c25c3abc4e508bfc6686b9698bf6208bf8032

SHA256
6723f61f1d556f5ee79eb58e71f11281b8ea13083d3080283a41cc0a83dab311

SHA512
c0f34dab5f5176ea94752c9b081888eaa7574dfb5103dd963076f6d368add411e4ce1961954a3175d553e3c3d3368b7ef1918fe664f6b00ccab24b754ff380d4

Download Submit
C:\Program Files\backup.exe

Filesize
338KB

MD5
17026371964375faf4fcc1f5bc77dbfe

SHA1
e2edea49b1cc2e62fcaf150d5c472ae28a7e5d00

SHA256
95b3dc1328defcda352fe3c6db291e11f5c85ceeb038d5d6edc115db62e90243

SHA512
983d1812549e1167eea9980840157e9d8387310ecd01f3fcdd0f0d80a79110aa08dd116ebc951308e52f3414d92f3c212a8d71923ad7e532e77e73ba637ca2b4

Download Submit
C:\Program Files\backup.exe

Filesize
338KB

MD5
17026371964375faf4fcc1f5bc77dbfe

SHA1
e2edea49b1cc2e62fcaf150d5c472ae28a7e5d00

SHA256
95b3dc1328defcda352fe3c6db291e11f5c85ceeb038d5d6edc115db62e90243

SHA512
983d1812549e1167eea9980840157e9d8387310ecd01f3fcdd0f0d80a79110aa08dd116ebc951308e52f3414d92f3c212a8d71923ad7e532e77e73ba637ca2b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2894544766\backup.exe

Filesize
338KB

MD5
fb4a40fe2382bf6fba9f60cff3142c0e

SHA1
b80035c9957f81825a0c9e400deae5577f1b8b1e

SHA256
123ed0ed88fe54b7ba2ef782073583198a222901fc7b4392df0c97778b2bf9f4

SHA512
6eaae254d492a77850f49674103242c005b8d1499f708dee2120c554988b8a3b6ee40bd20f0ae2cf4b6852d0010317148176dbbbd3c84f90bf3409657b60ef31

Download Submit
C:\Users\Admin\AppData\Local\Temp\2894544766\backup.exe

Filesize
338KB

MD5
fb4a40fe2382bf6fba9f60cff3142c0e

SHA1
b80035c9957f81825a0c9e400deae5577f1b8b1e

SHA256
123ed0ed88fe54b7ba2ef782073583198a222901fc7b4392df0c97778b2bf9f4

SHA512
6eaae254d492a77850f49674103242c005b8d1499f708dee2120c554988b8a3b6ee40bd20f0ae2cf4b6852d0010317148176dbbbd3c84f90bf3409657b60ef31

Download Submit
C:\Users\Admin\AppData\Local\Temp\2894544766\backup.exe

Filesize
338KB

MD5
fb4a40fe2382bf6fba9f60cff3142c0e

SHA1
b80035c9957f81825a0c9e400deae5577f1b8b1e

SHA256
123ed0ed88fe54b7ba2ef782073583198a222901fc7b4392df0c97778b2bf9f4

SHA512
6eaae254d492a77850f49674103242c005b8d1499f708dee2120c554988b8a3b6ee40bd20f0ae2cf4b6852d0010317148176dbbbd3c84f90bf3409657b60ef31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
338KB

MD5
c0ddd318703e39419cdc02393a474f32

SHA1
77a7b051fac6650a26a871757fd29c6953767391

SHA256
c515e0bc5b5e64a3024a82f0f2120dc39345eb79566534f60ef93b9a769b96bc

SHA512
1b331c68c2438c9be2b54902c2fffafff53de72021cbde05d5f5c3b64f13bc4dfaf6e38fb7a51c22f902b2f430117a8a8ebf4aa2bff8a6bad2f56d9faeb020b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
338KB

MD5
c0ddd318703e39419cdc02393a474f32

SHA1
77a7b051fac6650a26a871757fd29c6953767391

SHA256
c515e0bc5b5e64a3024a82f0f2120dc39345eb79566534f60ef93b9a769b96bc

SHA512
1b331c68c2438c9be2b54902c2fffafff53de72021cbde05d5f5c3b64f13bc4dfaf6e38fb7a51c22f902b2f430117a8a8ebf4aa2bff8a6bad2f56d9faeb020b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
338KB

MD5
cf906590771d53fd30bf84c905c5cb58

SHA1
dfe6b6f1292e2f71d2b1f8dd2b42dd071127bf67

SHA256
320ec4a29785bd0465e0f8ae8c18343407db1bf4f98f60abcc8f06209701b180

SHA512
3be9f648aa4aed366e52844140355a22d788c6fd656e82e6ad0f7288cdf681ced76ad695e6f95ce97afd23314bdd35e68717c2d0d690a48b4e9a64a7a73b3261

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
338KB

MD5
cf906590771d53fd30bf84c905c5cb58

SHA1
dfe6b6f1292e2f71d2b1f8dd2b42dd071127bf67

SHA256
320ec4a29785bd0465e0f8ae8c18343407db1bf4f98f60abcc8f06209701b180

SHA512
3be9f648aa4aed366e52844140355a22d788c6fd656e82e6ad0f7288cdf681ced76ad695e6f95ce97afd23314bdd35e68717c2d0d690a48b4e9a64a7a73b3261

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
338KB

MD5
cf906590771d53fd30bf84c905c5cb58

SHA1
dfe6b6f1292e2f71d2b1f8dd2b42dd071127bf67

SHA256
320ec4a29785bd0465e0f8ae8c18343407db1bf4f98f60abcc8f06209701b180

SHA512
3be9f648aa4aed366e52844140355a22d788c6fd656e82e6ad0f7288cdf681ced76ad695e6f95ce97afd23314bdd35e68717c2d0d690a48b4e9a64a7a73b3261

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
338KB

MD5
cf906590771d53fd30bf84c905c5cb58

SHA1
dfe6b6f1292e2f71d2b1f8dd2b42dd071127bf67

SHA256
320ec4a29785bd0465e0f8ae8c18343407db1bf4f98f60abcc8f06209701b180

SHA512
3be9f648aa4aed366e52844140355a22d788c6fd656e82e6ad0f7288cdf681ced76ad695e6f95ce97afd23314bdd35e68717c2d0d690a48b4e9a64a7a73b3261

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

Filesize
338KB

MD5
9d6e9a0523f6fa0a6f406857507f82b5

SHA1
e35eee2946fac0d99d50159d526cfbe80066f2f5

SHA256
77dbc482c5b65899c6e2983d5eb52bb4d5df7e7515d2ea3441a395bc77f39558

SHA512
a6468b5bb59fa07c6dea61e9225f95ee2c9a7ac6088721d59936f9fdbc911eeba5e098f7866fa2c6b31e7225ffb46001f4cdb2da885b2e409179ea549ff1c4a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe

Filesize
338KB

MD5
9d6e9a0523f6fa0a6f406857507f82b5

SHA1
e35eee2946fac0d99d50159d526cfbe80066f2f5

SHA256
77dbc482c5b65899c6e2983d5eb52bb4d5df7e7515d2ea3441a395bc77f39558

SHA512
a6468b5bb59fa07c6dea61e9225f95ee2c9a7ac6088721d59936f9fdbc911eeba5e098f7866fa2c6b31e7225ffb46001f4cdb2da885b2e409179ea549ff1c4a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

Filesize
338KB

MD5
f09c6cdcddbbea86e3f5aa58264a0298

SHA1
fe0c31830ff263353347d132947fcabe9ad5ce91

SHA256
878f784e09b5a61f4f5e07a86fe7528acc55b2c2eec812274c149ea3660a2e16

SHA512
6e6c6615084cd2734aff43b8f5a1710a4bf70060ecb5c101832cc9858dbd1ec7f510fa1eab144583185c432f315145de077417dfe837ddc1566872b122d8911d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe

Filesize
338KB

MD5
f09c6cdcddbbea86e3f5aa58264a0298

SHA1
fe0c31830ff263353347d132947fcabe9ad5ce91

SHA256
878f784e09b5a61f4f5e07a86fe7528acc55b2c2eec812274c149ea3660a2e16

SHA512
6e6c6615084cd2734aff43b8f5a1710a4bf70060ecb5c101832cc9858dbd1ec7f510fa1eab144583185c432f315145de077417dfe837ddc1566872b122d8911d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

Filesize
338KB

MD5
0ac6ff1529ea2abd6ffe78530e27dea9

SHA1
eaa9e2687c15058652dd71bb90032a888ab519e2

SHA256
386bbff422122f967a21c574bd74837a66c326932fbd7ce97de074f3f40b8075

SHA512
66d1b38f613f6ec08a4d3967c3d8ff612ed7fe60d56a68575a018109f5fd1908f19c77e327fb1d3696f9488485dbacb1fa6ce5e49307a0aeec9e8a8eb9abada5

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe

Filesize
338KB

MD5
0ac6ff1529ea2abd6ffe78530e27dea9

SHA1
eaa9e2687c15058652dd71bb90032a888ab519e2

SHA256
386bbff422122f967a21c574bd74837a66c326932fbd7ce97de074f3f40b8075

SHA512
66d1b38f613f6ec08a4d3967c3d8ff612ed7fe60d56a68575a018109f5fd1908f19c77e327fb1d3696f9488485dbacb1fa6ce5e49307a0aeec9e8a8eb9abada5

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\System Restore.exe

Filesize
338KB

MD5
c0ddd318703e39419cdc02393a474f32

SHA1
77a7b051fac6650a26a871757fd29c6953767391

SHA256
c515e0bc5b5e64a3024a82f0f2120dc39345eb79566534f60ef93b9a769b96bc

SHA512
1b331c68c2438c9be2b54902c2fffafff53de72021cbde05d5f5c3b64f13bc4dfaf6e38fb7a51c22f902b2f430117a8a8ebf4aa2bff8a6bad2f56d9faeb020b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\System Restore.exe

Filesize
338KB

MD5
c0ddd318703e39419cdc02393a474f32

SHA1
77a7b051fac6650a26a871757fd29c6953767391

SHA256
c515e0bc5b5e64a3024a82f0f2120dc39345eb79566534f60ef93b9a769b96bc

SHA512
1b331c68c2438c9be2b54902c2fffafff53de72021cbde05d5f5c3b64f13bc4dfaf6e38fb7a51c22f902b2f430117a8a8ebf4aa2bff8a6bad2f56d9faeb020b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
338KB

MD5
c0ddd318703e39419cdc02393a474f32

SHA1
77a7b051fac6650a26a871757fd29c6953767391

SHA256
c515e0bc5b5e64a3024a82f0f2120dc39345eb79566534f60ef93b9a769b96bc

SHA512
1b331c68c2438c9be2b54902c2fffafff53de72021cbde05d5f5c3b64f13bc4dfaf6e38fb7a51c22f902b2f430117a8a8ebf4aa2bff8a6bad2f56d9faeb020b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
338KB

MD5
c0ddd318703e39419cdc02393a474f32

SHA1
77a7b051fac6650a26a871757fd29c6953767391

SHA256
c515e0bc5b5e64a3024a82f0f2120dc39345eb79566534f60ef93b9a769b96bc

SHA512
1b331c68c2438c9be2b54902c2fffafff53de72021cbde05d5f5c3b64f13bc4dfaf6e38fb7a51c22f902b2f430117a8a8ebf4aa2bff8a6bad2f56d9faeb020b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
338KB

MD5
0ac6ff1529ea2abd6ffe78530e27dea9

SHA1
eaa9e2687c15058652dd71bb90032a888ab519e2

SHA256
386bbff422122f967a21c574bd74837a66c326932fbd7ce97de074f3f40b8075

SHA512
66d1b38f613f6ec08a4d3967c3d8ff612ed7fe60d56a68575a018109f5fd1908f19c77e327fb1d3696f9488485dbacb1fa6ce5e49307a0aeec9e8a8eb9abada5

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
338KB

MD5
0ac6ff1529ea2abd6ffe78530e27dea9

SHA1
eaa9e2687c15058652dd71bb90032a888ab519e2

SHA256
386bbff422122f967a21c574bd74837a66c326932fbd7ce97de074f3f40b8075

SHA512
66d1b38f613f6ec08a4d3967c3d8ff612ed7fe60d56a68575a018109f5fd1908f19c77e327fb1d3696f9488485dbacb1fa6ce5e49307a0aeec9e8a8eb9abada5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\CRX_INSTALL\backup.exe

Filesize
338KB

MD5
7a1e958f4b4120728b0c93016b114a67

SHA1
86a1266734d472723e9cd6cbfbab52afdaef6308

SHA256
3cfbe99de5f68084a4a7be41b8ca75bb35d794c0204fa511d5910e6377c05a54

SHA512
ce1e92b3bfe09f63c7587d071f1d4824a29be15784d5105efe404f7f7101f58dd82030f180def0e0e0c9a9ae730b635674fed8ba25a86939ed29b2def8fbf769

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\CRX_INSTALL\backup.exe

Filesize
338KB

MD5
7a1e958f4b4120728b0c93016b114a67

SHA1
86a1266734d472723e9cd6cbfbab52afdaef6308

SHA256
3cfbe99de5f68084a4a7be41b8ca75bb35d794c0204fa511d5910e6377c05a54

SHA512
ce1e92b3bfe09f63c7587d071f1d4824a29be15784d5105efe404f7f7101f58dd82030f180def0e0e0c9a9ae730b635674fed8ba25a86939ed29b2def8fbf769

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\backup.exe

Filesize
338KB

MD5
ef6252927d0a22b451da9778e49e4752

SHA1
ae5991b2725d232fe0a99b0e5faa13a484bcb3fc

SHA256
34021ea2339cbbb821abb1dd8c5a4e6988492a6247ce892c9393c95f9f54faf4

SHA512
8bd2abde5dffed91c3cc7c0b26b817fcfe072f657e644dcaa7660ee240c00232dacb7553fffc5bed98afc7f2fc478062c050aab7b30b3a68bc4b70983d4ced7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_1722516930\backup.exe

Filesize
338KB

MD5
ef6252927d0a22b451da9778e49e4752

SHA1
ae5991b2725d232fe0a99b0e5faa13a484bcb3fc

SHA256
34021ea2339cbbb821abb1dd8c5a4e6988492a6247ce892c9393c95f9f54faf4

SHA512
8bd2abde5dffed91c3cc7c0b26b817fcfe072f657e644dcaa7660ee240c00232dacb7553fffc5bed98afc7f2fc478062c050aab7b30b3a68bc4b70983d4ced7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\CRX_INSTALL\backup.exe

Filesize
338KB

MD5
7cb980490eb802ca1c18c0c604af4ad7

SHA1
05d0d41c3690d189d3dbf03cdb5d2100d9f66e3b

SHA256
06a176242fb81423ccc0f76e9608614a08a75bc1a2d78578fb59dc7604960c7b

SHA512
8cdda5f5e03efe82b5fad988405fcd4af6aeaff74ca5329b2ef90b63ba45407e25bc90b8178bd56bfc1c5b682a2fe515334fce5e5c63d60ada58bae577dbb081

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\CRX_INSTALL\backup.exe

Filesize
338KB

MD5
7cb980490eb802ca1c18c0c604af4ad7

SHA1
05d0d41c3690d189d3dbf03cdb5d2100d9f66e3b

SHA256
06a176242fb81423ccc0f76e9608614a08a75bc1a2d78578fb59dc7604960c7b

SHA512
8cdda5f5e03efe82b5fad988405fcd4af6aeaff74ca5329b2ef90b63ba45407e25bc90b8178bd56bfc1c5b682a2fe515334fce5e5c63d60ada58bae577dbb081

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\backup.exe

Filesize
338KB

MD5
513651924fa330a902928123db630e5a

SHA1
ffc97d03be9e4dd469cafe71bb14f62ab3b45fe1

SHA256
0f8c1f98b25dac9f5914a2f6303f6d4e570a014dbb3450632c8b396819fc8f0b

SHA512
2f460f8f0f15d2e6e87afc1c9c47505de98267bfed15a9a9a56f7baafb23eb789baf166ee1c967e3c1152d5401f07d6b5b59f84e3edb3d3853d53962916ec9cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir540_544490825\backup.exe

Filesize
338KB

MD5
513651924fa330a902928123db630e5a

SHA1
ffc97d03be9e4dd469cafe71bb14f62ab3b45fe1

SHA256
0f8c1f98b25dac9f5914a2f6303f6d4e570a014dbb3450632c8b396819fc8f0b

SHA512
2f460f8f0f15d2e6e87afc1c9c47505de98267bfed15a9a9a56f7baafb23eb789baf166ee1c967e3c1152d5401f07d6b5b59f84e3edb3d3853d53962916ec9cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\{AAA56600-45B8-4EF4-8ABF-C11D728EFCF9}\backup.exe

Filesize
338KB

MD5
fb4a40fe2382bf6fba9f60cff3142c0e

SHA1
b80035c9957f81825a0c9e400deae5577f1b8b1e

SHA256
123ed0ed88fe54b7ba2ef782073583198a222901fc7b4392df0c97778b2bf9f4

SHA512
6eaae254d492a77850f49674103242c005b8d1499f708dee2120c554988b8a3b6ee40bd20f0ae2cf4b6852d0010317148176dbbbd3c84f90bf3409657b60ef31

Download Submit
C:\Users\Admin\AppData\Local\Temp\{AAA56600-45B8-4EF4-8ABF-C11D728EFCF9}\backup.exe

Filesize
338KB

MD5
fb4a40fe2382bf6fba9f60cff3142c0e

SHA1
b80035c9957f81825a0c9e400deae5577f1b8b1e

SHA256
123ed0ed88fe54b7ba2ef782073583198a222901fc7b4392df0c97778b2bf9f4

SHA512
6eaae254d492a77850f49674103242c005b8d1499f708dee2120c554988b8a3b6ee40bd20f0ae2cf4b6852d0010317148176dbbbd3c84f90bf3409657b60ef31

Download Submit
C:\backup.exe

Filesize
338KB

MD5
7374943c71d0dccadb7581ed5be61ba9

SHA1
55fd4eb94df9803416cba79b2351bbab0edf5205

SHA256
70fc74c6c26c030c387b324e75725f7d2a667fabd94bbc2b39c7b3f9c6b9b4f5

SHA512
ec355fd1d536dc09ef402f66a3222dcc42e9fb5c9981698bb90dfd3fe588ede271a4c648543771c7cc0d4fbc67e9512f600e7692dc391a91b79d04bb37a19754

Download Submit
C:\backup.exe

Filesize
338KB

MD5
7374943c71d0dccadb7581ed5be61ba9

SHA1
55fd4eb94df9803416cba79b2351bbab0edf5205

SHA256
70fc74c6c26c030c387b324e75725f7d2a667fabd94bbc2b39c7b3f9c6b9b4f5

SHA512
ec355fd1d536dc09ef402f66a3222dcc42e9fb5c9981698bb90dfd3fe588ede271a4c648543771c7cc0d4fbc67e9512f600e7692dc391a91b79d04bb37a19754

Download Submit
C:\odt\backup.exe

Filesize
338KB

MD5
a95c8349e045e6730aacc53eb80cf00b

SHA1
c0c2776c51a0459121ed2d69b06c60f5b8a0510d

SHA256
f155f3c3ff449c133c28a7c403f412df4a28008272995eefae9c3a9ac0c46c54

SHA512
67cd54e80d4185073240f671d08ca33fe180ac0d1c9ecd1810d0d856da46c4dfd270524179a75aed31ffc55177536d49ed5b1755d8514de45e60a7e1fe95f80e

Download Submit
C:\odt\backup.exe

Filesize
338KB

MD5
a95c8349e045e6730aacc53eb80cf00b

SHA1
c0c2776c51a0459121ed2d69b06c60f5b8a0510d

SHA256
f155f3c3ff449c133c28a7c403f412df4a28008272995eefae9c3a9ac0c46c54

SHA512
67cd54e80d4185073240f671d08ca33fe180ac0d1c9ecd1810d0d856da46c4dfd270524179a75aed31ffc55177536d49ed5b1755d8514de45e60a7e1fe95f80e

Download Submit
memory/208-289-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/400-80-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/724-232-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/760-374-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/820-395-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/820-108-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/872-240-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/880-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/880-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1112-292-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1148-14-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1148-28-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1164-265-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1196-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1260-235-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1432-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1432-303-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1496-223-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1500-373-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1528-375-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1528-330-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2028-218-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2028-51-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2100-190-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2300-227-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2404-32-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2536-142-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2684-351-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2748-260-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2980-335-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3068-103-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3228-254-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3272-243-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3308-208-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3344-74-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3408-170-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3500-381-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3648-283-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3784-164-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3884-111-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3900-141-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3912-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3920-385-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3968-344-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3988-384-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4200-209-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4200-113-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4204-185-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4220-357-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4328-203-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4348-270-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4348-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4376-68-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4404-306-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4428-318-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4472-184-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4504-165-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4692-247-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4692-95-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4700-194-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4748-333-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4780-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4780-274-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5028-377-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads