7ead8dd23a4e5a9e1cfbe8a92923d7572c62fcb47b3a65e428c62693eefb11d1

Analysis

max time kernel
0s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d93f6ee80e089c2af0b071c33ac736.exe
Size

72KB
MD5

04d93f6ee80e089c2af0b071c33ac736
SHA1

1900911ea3b26d0068ca8852ad3f332897f70829
SHA256

7ead8dd23a4e5a9e1cfbe8a92923d7572c62fcb47b3a65e428c62693eefb11d1
SHA512

c31da85dc0f135f92153a588642d4e90dd03432fa8ce4efb591aee9d0e0ea64e04066d1c590bde3de77aa3419cbc627a6b3ce69002bdd7f07f665e5ad8ad9a03
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2i:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPW

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 1 IoCs

pid	Process
2928	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
2420	backup.exe
2420	backup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	backup.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2928	2420	backup.exe	1080
PID 2420 wrote to memory of 2928	2420	backup.exe	1080
PID 2420 wrote to memory of 2928	2420	backup.exe	1080
PID 2420 wrote to memory of 2928	2420	backup.exe	1080

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\04d93f6ee80e089c2af0b071c33ac736.exe
"C:\Users\Admin\AppData\Local\Temp\04d93f6ee80e089c2af0b071c33ac736.exe"
1⤵
PID:2420
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  PID:2640
- C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
  2⤵
  PID:1712

C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
1⤵
PID:1512

C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
1⤵
PID:2352
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
  2⤵
  PID:1804

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:2140
- C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\modules\
  2⤵
  PID:2484

C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
1⤵
PID:1200

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:2220
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
  2⤵
  PID:2792
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
  2⤵
  PID:2180

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
1⤵
PID:2072

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
1⤵
PID:3068
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:2340
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
  2⤵
  PID:2404
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
  2⤵
  PID:964
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
  2⤵
  PID:2596
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
    3⤵
    PID:1500
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
  2⤵
  PID:2472

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
1⤵
PID:2532

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
1⤵
PID:2672

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
1⤵
PID:2476
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
  2⤵
  PID:2760

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
1⤵
PID:2848
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\data.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
  2⤵
  PID:2844

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
1⤵
PID:1128

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
1⤵
PID:1736

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
1⤵
PID:2888

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
1⤵
PID:1640
- C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
  2⤵
  PID:1220
- C:\Program Files\Java\jre7\lib\zi\Asia\data.exe
  "C:\Program Files\Java\jre7\lib\zi\Asia\data.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
  2⤵
  PID:768
- C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
  2⤵
  PID:2688
- C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe" C:\Program Files\Java\jre7\lib\zi\Europe\
  2⤵
  PID:2924
- C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
  2⤵
  PID:2820
- - C:\Program Files\DVD Maker\Shared\backup.exe
    "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
    3⤵
    PID:2492
- - C:\Program Files\DVD Maker\ja-JP\backup.exe
    "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
    3⤵
    PID:1704
- - C:\Program Files\DVD Maker\it-IT\backup.exe
    "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
    3⤵
    PID:1940
- - C:\Program Files\DVD Maker\fr-FR\backup.exe
    "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
    3⤵
    PID:1108
- - C:\Program Files\DVD Maker\es-ES\update.exe
    "C:\Program Files\DVD Maker\es-ES\update.exe" C:\Program Files\DVD Maker\es-ES\
    3⤵
    PID:2824
- - C:\Program Files\DVD Maker\en-US\backup.exe
    "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
    3⤵
    PID:2028
- - C:\Program Files\DVD Maker\de-DE\backup.exe
    "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
    3⤵
    PID:1264

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
1⤵
PID:2448

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
1⤵
PID:536
- C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
  2⤵
  PID:1632
- C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\
  2⤵
  PID:2224

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
1⤵
PID:1256

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:992
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
  2⤵
  PID:1684
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
  2⤵
  PID:2400
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
  2⤵
  PID:1984

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
1⤵
PID:1152

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:1100
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
  2⤵
  PID:2764
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
  2⤵
  PID:3068
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
  2⤵
  PID:2724
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
  2⤵
  PID:2604

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
1⤵
PID:2604
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\
  2⤵
  PID:1744
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\
  2⤵
  PID:1944
- C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
  2⤵
  PID:2180

C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
1⤵
PID:2616

C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
1⤵
PID:2864

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2084
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:820
- - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
    3⤵
    PID:2976
  - - C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
      4⤵
      PID:1948
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:1764

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:2840

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
1⤵
PID:2012

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
1⤵
PID:2240
- C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
  2⤵
  PID:2592

C:\Program Files\Common Files\System\ado\de-DE\update.exe
"C:\Program Files\Common Files\System\ado\de-DE\update.exe" C:\Program Files\Common Files\System\ado\de-DE\
1⤵
PID:852
- C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
  2⤵
  PID:2452

C:\Program Files\Common Files\System\msadc\backup.exe
"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
1⤵
PID:2316
- C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
  2⤵
  PID:2684
- C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
  2⤵
  PID:2480
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
    3⤵
    PID:2316
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Common Files\Services\backup.exe
      "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Common Files\System\backup.exe
      "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
      4⤵
      PID:2092
    - - C:\Program Files (x86)\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\
        5⤵
        
        PID:1264
      - C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\data.exe
        
        "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\data.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
        6⤵
        
        PID:864
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
        5⤵
        
        PID:1820
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
        5⤵
        
        PID:2512
      - C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
        6⤵
        
        PID:2856
      - C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
        6⤵
        
        PID:1084
      - C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
        6⤵
        
        PID:3016
      - C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
        6⤵
        
        PID:2652
    - - C:\Program Files (x86)\Common Files\System\en-US\data.exe
        
        "C:\Program Files (x86)\Common Files\System\en-US\data.exe" C:\Program Files (x86)\Common Files\System\en-US\
        5⤵
        
        PID:2664
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        5⤵
        
        PID:3040
  - - C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
      "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
      4⤵
      PID:2692
    - - C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
        5⤵
        
        PID:2140
      - C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\
        6⤵
        
        PID:2168
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
        7⤵
        
        PID:2940
      - C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\
        6⤵
        
        PID:1724
        
        C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\
        7⤵
        
        PID:2748
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
        8⤵
        
        PID:2740
    - - C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\
        5⤵
        
        PID:2756
    - - C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
        5⤵
        
        PID:2804
    - - C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\
        5⤵
        
        PID:1764
    - - C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
        5⤵
        
        PID:844
    - - C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\
        5⤵
        
        PID:2064
    - - C:\Program Files\Microsoft Games\Purble Place\en-US\update.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\en-US\update.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
        5⤵
        
        PID:1916
    - - C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
        5⤵
        
        PID:592
    - - C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
        5⤵
        
        PID:1512
    - - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\
        5⤵
        
        PID:2792
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
        6⤵
        
        PID:2752
    - - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\
        5⤵
        
        PID:276
    - - C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\
        5⤵
        
        PID:2348
  - - C:\Program Files (x86)\Common Files\DESIGNER\update.exe
      "C:\Program Files (x86)\Common Files\DESIGNER\update.exe" C:\Program Files (x86)\Common Files\DESIGNER\
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Common Files\Adobe\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
      4⤵
      PID:3028
    - - C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
        5⤵
        
        PID:1068
    - - C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
        5⤵
        
        PID:1084
    - - C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
        5⤵
        
        PID:2764
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
    3⤵
    PID:3024
  - - C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
      4⤵
      PID:1680
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
    3⤵
    PID:2356
  - - C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
      4⤵
      PID:2772
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
    3⤵
    PID:2296
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
    3⤵
    PID:2476
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\System Restore.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\System Restore.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
    3⤵
    PID:2180
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
    3⤵
    PID:2792

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:2940

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
1⤵
PID:1400

C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
1⤵
PID:484

C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
1⤵
PID:556

C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
1⤵
PID:1552

C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
1⤵
PID:2128

C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
1⤵
PID:2072

C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
1⤵
PID:376

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:3012

C:\Program Files\Google\Chrome\Application\backup.exe
"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
1⤵
PID:2684

C:\Program Files\Internet Explorer\de-DE\backup.exe
"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:2956

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
1⤵
PID:1256

C:\Program Files\Java\jdk1.7.0_80\jre\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
1⤵
PID:2236
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
  2⤵
  PID:2328
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
    3⤵
    PID:2608
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\
    3⤵
    PID:2704
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
    3⤵
    PID:2584
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
      4⤵
      PID:2540
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
        5⤵
        
        PID:1796
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
        5⤵
        
        PID:2796
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
      4⤵
      PID:2956
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
      4⤵
      PID:2948
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
      4⤵
      PID:1320
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
      4⤵
      PID:1700
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
    3⤵
    PID:1200

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
1⤵
PID:2400

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
1⤵
PID:1912
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
  2⤵
  PID:1200
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
    3⤵
    PID:2072
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
    3⤵
    PID:2920
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
    3⤵
    PID:2404
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
    3⤵
    PID:2704
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:952
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
      4⤵
      PID:2800
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
        5⤵
        
        PID:968
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
        5⤵
        
        PID:1752
      - C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
        6⤵
        
        PID:1628
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
    3⤵
    PID:2800
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\System Restore.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
    3⤵
    PID:968
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
  2⤵
  PID:2220
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
  2⤵
  PID:1904
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
  2⤵
  PID:536
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
  2⤵
  PID:1408

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
1⤵
PID:2000

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
1⤵
PID:1644

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
1⤵
PID:2052

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\
1⤵
PID:1928
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
  2⤵
  PID:1688
- - C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
    3⤵
    PID:2324

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
1⤵
PID:2256
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
  2⤵
  PID:2188
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
  2⤵
  PID:2756

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
1⤵
PID:2264

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
1⤵
PID:2324
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
  2⤵
  PID:2456

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
1⤵
PID:2964

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
1⤵
PID:3000

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
1⤵
PID:624
- C:\Program Files\VideoLAN\VLC\locale\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
  2⤵
  PID:2544
- - C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\
    3⤵
    PID:2976
- - C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
    3⤵
    PID:1480
  - - C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
      4⤵
      PID:800
    - - C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
        5⤵
        
        PID:1508
- - C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
    3⤵
    PID:2740
- - C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
    3⤵
    PID:2704
- - C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
    3⤵
    PID:968
  - - C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
      4⤵
      PID:1464
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
      4⤵
      PID:2444
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
      4⤵
      PID:2328
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
        5⤵
        
        PID:2676
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
        5⤵
        
        PID:1944
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
        5⤵
        
        PID:2504
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
        5⤵
        
        PID:2736
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
        5⤵
        
        PID:2700
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
        5⤵
        
        PID:1896
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
        5⤵
        
        PID:1772
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
        5⤵
        
        PID:1624
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
      4⤵
      PID:276
- - C:\Program Files\VideoLAN\VLC\locale\es\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\
    3⤵
    PID:448
- - C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
    3⤵
    PID:1552
- - C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
    3⤵
    PID:2404
- - C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
    3⤵
    PID:1620
  - - C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
      4⤵
      PID:2468
- - C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\
    3⤵
    PID:2876
  - - C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
      4⤵
      PID:2504
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
        5⤵
        
        PID:2532
- - C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\
    3⤵
    PID:2748
  - - C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
      4⤵
      PID:3008
- - C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\
    3⤵
    PID:1536
  - - C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
      4⤵
      PID:564
- - C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\
    3⤵
    PID:2272
- - C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
    3⤵
    PID:2028
- - C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
    3⤵
    PID:1992
  - - C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
      4⤵
      PID:2676
- - C:\Program Files\VideoLAN\VLC\locale\ko\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\ko\update.exe" C:\Program Files\VideoLAN\VLC\locale\ko\
    3⤵
    PID:2532
- - C:\Program Files\VideoLAN\VLC\locale\ks_IN\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\ks_IN\update.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\
    3⤵
    PID:2704
- - C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
    3⤵
    PID:2932
  - - C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
      4⤵
      PID:1888
- - C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
    3⤵
    PID:2584
  - - C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
      4⤵
      PID:1560
- - C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\
    3⤵
    PID:2804
- - C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\
    3⤵
    PID:1304
  - - C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
      4⤵
      PID:1724
- - C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
    3⤵
    PID:3032
- - C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
    3⤵
    PID:2180
  - - C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
      4⤵
      PID:2084
    - - C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
        5⤵
        
        PID:1996
    - - C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
        5⤵
        
        PID:1480
    - - C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
        5⤵
        
        PID:548
    - - C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
        5⤵
        
        PID:2488
- - C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
    3⤵
    PID:2016
  - - C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
      4⤵
      PID:2516
- - C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
    3⤵
    PID:1676
- - C:\Program Files\VideoLAN\VLC\locale\nb\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\nb\update.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
    3⤵
    PID:2736
  - - C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
      4⤵
      PID:2716
    - - C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
        
        "C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
        5⤵
        
        PID:1428
- - C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\
    3⤵
    PID:2648
- - C:\Program Files\VideoLAN\VLC\locale\oc\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\oc\update.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
    3⤵
    PID:2688
  - - C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
      4⤵
      PID:2128
    - - C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
        5⤵
        
        PID:2752
- - C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
    3⤵
    PID:2740
  - - C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
      4⤵
      PID:2296
  - - C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
      4⤵
      PID:1744
- - C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
    3⤵
    PID:2720
  - - C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\
      4⤵
      PID:1604
- - C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\
    3⤵
    PID:1480
  - - C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\
      4⤵
      PID:2348
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
        5⤵
        
        PID:2444
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
        5⤵
        
        PID:2996
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
        5⤵
        
        PID:1268
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\
        5⤵
        
        PID:2644
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
        6⤵
        
        PID:1612
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
        6⤵
        
        PID:1980
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
        6⤵
        
        PID:1648
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
        7⤵
        
        PID:2980
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
        7⤵
        
        PID:2824
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        6⤵
        
        PID:2932
        
        C:\Program Files\Common Files\Microsoft Shared\VGX\data.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VGX\data.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
        7⤵
        
        PID:2996
        
        C:\Program Files\Common Files\Microsoft Shared\TextConv\data.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
        7⤵
        
        PID:3028
        
        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
        7⤵
        
        PID:1728
        
        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
        7⤵
        
        PID:1776
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
        6⤵
        
        PID:3004
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        6⤵
        
        PID:580
        
        C:\Program Files\Common Files\System\Ole DB\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
        7⤵
        
        PID:1956
        
        C:\Program Files\Common Files\System\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
        7⤵
        
        PID:912
        
        C:\Program Files\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
        7⤵
        
        PID:320
        
        C:\Program Files\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
        7⤵
        
        PID:2312
        
        C:\Program Files\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
        7⤵
        
        PID:2392
        
        C:\Program Files\Common Files\System\en-US\update.exe
        
        "C:\Program Files\Common Files\System\en-US\update.exe" C:\Program Files\Common Files\System\en-US\
        7⤵
        
        PID:1684
        
        C:\Program Files\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
        7⤵
        
        PID:2280
        
        C:\Program Files\Common Files\System\ado\data.exe
        
        "C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\
        7⤵
        
        PID:1544
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\update.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
        5⤵
        
        PID:2572
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
        5⤵
        
        PID:2512
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
        6⤵
        
        PID:2848
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
        6⤵
        
        PID:2596
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\
        5⤵
        
        PID:2576
- - C:\Program Files\VideoLAN\VLC\locale\ru\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\ru\update.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
    3⤵
    PID:2584
  - - C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\
      4⤵
      PID:1836
- - C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\
    3⤵
    PID:992
  - - C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
      4⤵
      PID:904
    - - C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
        5⤵
        
        PID:284
      - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\update.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
        6⤵
        
        PID:1544
        
        C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
        7⤵
        
        PID:1924
        
        C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        7⤵
        
        PID:1256
        
        C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        7⤵
        
        PID:536
        
        C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        7⤵
        
        PID:2452
        
        C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        7⤵
        
        PID:2448
      - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
        6⤵
        
        PID:1932
- - C:\Program Files\VideoLAN\VLC\locale\sq\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\sq\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\sq\
    3⤵
    PID:1216
  - - C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\
      4⤵
      PID:2628
- - C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
    3⤵
    PID:1772
- - C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\
    3⤵
    PID:2852
  - - C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
      4⤵
      PID:2468
- - C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\
    3⤵
    PID:2752
  - - C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\
      4⤵
      PID:2652
- - C:\Program Files\VideoLAN\VLC\locale\si\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\si\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\
    3⤵
    PID:2312
- - C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\
    3⤵
    PID:1996
  - - C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\
      4⤵
      PID:2108
- - C:\Program Files\VideoLAN\VLC\locale\tet\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tet\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\
    3⤵
    PID:2836
  - - C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\
      4⤵
      PID:2072
- - C:\Program Files\VideoLAN\VLC\locale\te\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\te\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\
    3⤵
    PID:2516
- - C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\
    3⤵
    PID:2792
  - - C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
      4⤵
      PID:2876
- - C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\
    3⤵
    PID:2272
  - - C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\
      4⤵
      PID:2532
    - - C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
        
        "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
        5⤵
        
        PID:1520
    - - C:\Program Files\Mozilla Firefox\browser\features\backup.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
        5⤵
        
        PID:2752
  - - C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\
      4⤵
      PID:2712
- - C:\Program Files\VideoLAN\VLC\locale\th\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\th\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\
    3⤵
    PID:1616
  - - C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
      4⤵
      PID:1552
    - - C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\
        5⤵
        
        PID:2248
- - C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
    3⤵
    PID:2772
  - - C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
      4⤵
      PID:1376
- - C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\
    3⤵
    PID:1784
- - C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
    3⤵
    PID:2436
- - C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
    3⤵
    PID:1728
- - C:\Program Files\VideoLAN\VLC\locale\nn\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\nn\update.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
    3⤵
    PID:2248
- - C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
    3⤵
    PID:2360
- - C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
    3⤵
    PID:1904
  - - C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\
      4⤵
      PID:292
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
      4⤵
      PID:1972
- - C:\Program Files\VideoLAN\VLC\locale\uz\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\uz\data.exe" C:\Program Files\VideoLAN\VLC\locale\uz\
    3⤵
    PID:2108
  - - C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\
      4⤵
      PID:2796
- - C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\
    3⤵
    PID:2128
- - C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\
    3⤵
    PID:2648
  - - C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
      4⤵
      PID:2620
- - C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\
    3⤵
    PID:1596
  - - C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\
      4⤵
      PID:1700
    - - C:\Program Files\Internet Explorer\SIGNUP\backup.exe
        
        "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
        5⤵
        
        PID:448
    - - C:\Program Files\Internet Explorer\ja-JP\backup.exe
        
        "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
        5⤵
        
        PID:1952
    - - C:\Program Files\Internet Explorer\it-IT\backup.exe
        
        "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
        5⤵
        
        PID:704
    - - C:\Program Files\Internet Explorer\images\backup.exe
        
        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
        5⤵
        
        PID:1756
    - - C:\Program Files\Internet Explorer\fr-FR\backup.exe
        
        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
        5⤵
        
        PID:2016
    - - C:\Program Files\Internet Explorer\es-ES\backup.exe
        
        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
        5⤵
        
        PID:2948
    - - C:\Program Files\Internet Explorer\en-US\backup.exe
        
        "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
        5⤵
        
        PID:1652
  - - C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
      "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
      4⤵
      PID:2848
- - C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
    3⤵
    PID:1612
- - C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
    3⤵
    PID:3060
- - C:\Program Files\VideoLAN\VLC\locale\mai\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\mai\data.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
    3⤵
    PID:2384
- - C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\
    3⤵
    PID:2720
- - C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\
    3⤵
    PID:1980
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
      4⤵
      PID:2004
- - C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
    3⤵
    PID:992
- - C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
    3⤵
    PID:1616
- - C:\Program Files\VideoLAN\VLC\locale\it\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\it\update.exe" C:\Program Files\VideoLAN\VLC\locale\it\
    3⤵
    PID:1088
  - - C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
      4⤵
      PID:2424
- - C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
    3⤵
    PID:800
  - - C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
      4⤵
      PID:2064
- - C:\Program Files\VideoLAN\VLC\locale\ia\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\ia\data.exe" C:\Program Files\VideoLAN\VLC\locale\ia\
    3⤵
    PID:2944
- - C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
    3⤵
    PID:2640
- - C:\Program Files\VideoLAN\VLC\locale\he\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\
    3⤵
    PID:1688
- - C:\Program Files\VideoLAN\VLC\locale\gu\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\gu\data.exe" C:\Program Files\VideoLAN\VLC\locale\gu\
    3⤵
    PID:1772
- - C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
    3⤵
    PID:1752
- - C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
    3⤵
    PID:1088
  - - C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
      4⤵
      PID:604
  - - C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
      4⤵
      PID:2448
  - - C:\Program Files\Microsoft Games\Mahjong\es-ES\System Restore.exe
      "C:\Program Files\Microsoft Games\Mahjong\es-ES\System Restore.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
      4⤵
      PID:448
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
        5⤵
        
        PID:2236
      - C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
        6⤵
        
        PID:1120
  - - C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
      4⤵
      PID:2892
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
        5⤵
        
        PID:284
  - - C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
      4⤵
      PID:1636
- - C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
    3⤵
    PID:800
- - C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
    3⤵
    PID:1940
- - C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\
    3⤵
    PID:680
  - - C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\
      4⤵
      PID:2944
- - C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\
    3⤵
    PID:2772
- - C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
    3⤵
    PID:1716
- - C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
    3⤵
    PID:852
  - - C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
      4⤵
      PID:844
- - C:\Program Files\VideoLAN\VLC\locale\el\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\
    3⤵
    PID:2996
- - C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
    3⤵
    PID:1540
- - C:\Program Files\VideoLAN\VLC\locale\cy\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\cy\data.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
    3⤵
    PID:2604
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
      4⤵
      PID:1268
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\
      4⤵
      PID:2876
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\
      4⤵
      PID:2020
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
      4⤵
      PID:2468
- - C:\Program Files\VideoLAN\VLC\locale\co\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\
    3⤵
    PID:2628
- - C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\
    3⤵
    PID:904
- - C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
    3⤵
    PID:996
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
      4⤵
      PID:2256
    - - C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
        5⤵
        
        PID:1564
    - - C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
        5⤵
        
        PID:2452
    - - C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
        5⤵
        
        PID:1912
    - - C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
        5⤵
        
        PID:284
    - - C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
        5⤵
        
        PID:1400
    - - C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
        5⤵
        
        PID:2892
    - - C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
        5⤵
        
        PID:2712
    - - C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
        5⤵
        
        PID:2784
- - C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
    3⤵
    PID:1924
- - C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
    3⤵
    PID:660
- - C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
    3⤵
    PID:1420
- - C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
    3⤵
    PID:548
- - C:\Program Files\VideoLAN\VLC\locale\bg\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\bg\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
    3⤵
    PID:3024
- - C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
    3⤵
    PID:2240
- - C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
    3⤵
    PID:1564
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\
      4⤵
      PID:1984
- - C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
    3⤵
    PID:1928
- - C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
    3⤵
    PID:608
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\update.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\data.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\data.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\
      4⤵
      PID:3052
    - - C:\Program Files\Microsoft Games\More Games\backup.exe
        
        "C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\
        5⤵
        
        PID:652
    - - C:\Program Files\Microsoft Games\Minesweeper\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2420
    - - C:\Program Files\Microsoft Games\Mahjong\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
        5⤵
        
        PID:1088
- - C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
    3⤵
    PID:2364
- - C:\Program Files\VideoLAN\VLC\locale\an\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\an\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\an\
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
    3⤵
    PID:1480
- - C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
    3⤵
    PID:2356
- - C:\Program Files\VideoLAN\VLC\locale\ach\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\ach\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
    3⤵
    PID:1656
  - - C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
      4⤵
      PID:1520
  - - C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
      4⤵
      PID:1632
  - - C:\Program Files\Java\jdk1.7.0_80\db\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\
      4⤵
      PID:852
  - - C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
      4⤵
      PID:1928
- - C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\
    3⤵
    PID:2308
  - - C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\
      4⤵
      PID:1628
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\
      4⤵
      PID:1728
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
      4⤵
      PID:2560
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
      4⤵
      PID:1564
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
      4⤵
      PID:1928
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
        5⤵
        
        PID:2352
- - C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\
    3⤵
    PID:1596
  - - C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
      4⤵
      PID:1220
  - - C:\Program Files\Common Files\System\backup.exe
      "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
      4⤵
      PID:580
  - - C:\Program Files\Common Files\SpeechEngines\backup.exe
      "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
      4⤵
      PID:2816
  - - C:\Program Files\Common Files\Services\backup.exe
      "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
      4⤵
      PID:484
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
    3⤵
    PID:1944
- C:\Program Files\VideoLAN\VLC\lua\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
  2⤵
  PID:2220
- - C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
    3⤵
    PID:3056
- - C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
    3⤵
    PID:1220
  - - C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
      4⤵
      PID:2000
    - - C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
        5⤵
        
        PID:1168
  - - C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\images\
      4⤵
      PID:2764
  - - C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\js\
      4⤵
      PID:2880
    - - C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
        5⤵
        
        PID:2120
    - - C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
        5⤵
        
        PID:2720
    - - C:\Program Files\Microsoft Games\FreeCell\en-US\System Restore.exe
        
        "C:\Program Files\Microsoft Games\FreeCell\en-US\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
        5⤵
        
        PID:948
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\
        5⤵
        
        PID:2316
      - C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
        6⤵
        
        PID:2716
      - C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
        6⤵
        
        PID:2272
      - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
        6⤵
        
        PID:3012
      - C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
        6⤵
        
        PID:2860
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
        5⤵
        
        PID:3060
  - - C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
      4⤵
      PID:2732
  - - C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
      4⤵
      PID:2824
- - C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
    3⤵
    PID:1656
  - - C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\art\
      4⤵
      PID:2720
  - - C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
      4⤵
      PID:2536
- - C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
    3⤵
    PID:1660
- - C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
    3⤵
    PID:2628
  - - C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
      4⤵
      PID:2748
- - C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
    3⤵
    PID:2828
- - C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
    3⤵
    PID:2140
- C:\Program Files\VideoLAN\VLC\plugins\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\
  2⤵
  PID:2684
- - C:\Program Files\VideoLAN\VLC\plugins\access\data.exe
    "C:\Program Files\VideoLAN\VLC\plugins\access\data.exe" C:\Program Files\VideoLAN\VLC\plugins\access\
    3⤵
    PID:548
  - - C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
      4⤵
      PID:2656
- - C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access_output\
    3⤵
    PID:1244
  - - C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
      4⤵
      PID:724
- - C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
    3⤵
    PID:2056
- - C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\
    3⤵
    PID:2424
- - C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_output\
    3⤵
    PID:1416
- - C:\Program Files\VideoLAN\VLC\plugins\codec\data.exe
    "C:\Program Files\VideoLAN\VLC\plugins\codec\data.exe" C:\Program Files\VideoLAN\VLC\plugins\codec\
    3⤵
    PID:768
- - C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\control\
    3⤵
    PID:572
- - C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
    3⤵
    PID:2440
- - C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
    3⤵
    PID:2480
- - C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d9\
    3⤵
    PID:1408
- C:\Program Files\VideoLAN\VLC\skins\backup.exe
  "C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
  2⤵
  PID:920
- - C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
    "C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
    3⤵
    PID:1592
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\
      4⤵
      PID:1560
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\
      4⤵
      PID:2304
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\
      4⤵
      PID:2528
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\
      4⤵
      PID:2356
- C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
  "C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
  2⤵
  PID:1456
- - C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
    3⤵
    PID:2740
- - C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
    3⤵
    PID:2700
- - C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\
    3⤵
    PID:2888
  - - C:\Windows\AppCompat\data.exe
      C:\Windows\AppCompat\data.exe C:\Windows\AppCompat\
      4⤵
      PID:2616
  - - C:\Windows\AppPatch\backup.exe
      C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
      4⤵
      PID:2892
    - - C:\Windows\AppPatch\AppPatch64\backup.exe
        
        C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
        5⤵
        
        PID:1840
    - - C:\Windows\AppPatch\Custom\backup.exe
        
        C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\
        5⤵
        
        PID:2292
  - - C:\Windows\assembly\backup.exe
      C:\Windows\assembly\backup.exe C:\Windows\assembly\
      4⤵
      PID:2604
  - - C:\Windows\Branding\backup.exe
      C:\Windows\Branding\backup.exe C:\Windows\Branding\
      4⤵
      PID:1304
- - C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
    3⤵
    PID:2576
- - C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
    3⤵
    PID:2400
- - C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
    3⤵
    PID:992

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
1⤵
PID:2388

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:652
- C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
  2⤵
  PID:1984
- C:\Program Files\Microsoft Games\More Games\en-US\backup.exe
  "C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\
  2⤵
  PID:2092
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
    3⤵
    PID:2644
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
      4⤵
      PID:2080
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
      4⤵
      PID:1744
- C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
  2⤵
  PID:2128

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
1⤵
PID:2456

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
1⤵
PID:2592

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
1⤵
PID:2168

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
1⤵
PID:2080

C:\Program Files\Java\jre7\bin\backup.exe
"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
1⤵
PID:2520
- C:\Program Files\Java\jre7\bin\plugin2\backup.exe
  "C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
  2⤵
  PID:2580
- C:\Program Files\Java\jre7\bin\server\backup.exe
  "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
  2⤵
  PID:2772
- C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
  2⤵
  PID:1748

C:\Program Files\Java\jre7\lib\backup.exe
"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
1⤵
PID:816
- C:\Program Files\Java\jre7\lib\applet\System Restore.exe
  "C:\Program Files\Java\jre7\lib\applet\System Restore.exe" C:\Program Files\Java\jre7\lib\applet\
  2⤵
  PID:1420
- - C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
    3⤵
    PID:2948
- C:\Program Files\Java\jre7\lib\deploy\backup.exe
  "C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\
  2⤵
  PID:2980
- - C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
    3⤵
    PID:484
- C:\Program Files\Java\jre7\lib\fonts\backup.exe
  "C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\
  2⤵
  PID:2548
- - C:\Program Files\Reference Assemblies\Microsoft\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
    3⤵
    PID:1936
- C:\Program Files\Java\jre7\lib\management\backup.exe
  "C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
  2⤵
  PID:2892
- C:\Program Files\Java\jre7\lib\zi\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
  2⤵
  PID:1640
- C:\Program Files\Java\jre7\lib\security\backup.exe
  "C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
  2⤵
  PID:2584
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
    3⤵
    PID:1952
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
    3⤵
    PID:1756
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
    3⤵
    PID:1604
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
    3⤵
    PID:1784
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
    3⤵
    PID:2808
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
    3⤵
    PID:864
- C:\Program Files\Java\jre7\lib\jfr\backup.exe
  "C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
  2⤵
  PID:1636
- C:\Program Files\Java\jre7\lib\images\backup.exe
  "C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
  2⤵
  PID:1756
- C:\Program Files\Java\jre7\lib\ext\backup.exe
  "C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
  2⤵
  PID:2948
- C:\Program Files\Java\jre7\lib\cmm\backup.exe
  "C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
  2⤵
  PID:2944
- C:\Program Files\Java\jre7\lib\amd64\update.exe
  "C:\Program Files\Java\jre7\lib\amd64\update.exe" C:\Program Files\Java\jre7\lib\amd64\
  2⤵
  PID:2028

C:\Program Files\Java\jre7\lib\images\cursors\backup.exe
"C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\
1⤵
PID:1888

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
1⤵
PID:1764

C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
1⤵
PID:1928
- C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
  2⤵
  PID:2384

C:\Program Files\Microsoft Games\Chess\backup.exe
"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
1⤵
PID:2512
- C:\Program Files\Microsoft Games\Chess\es-ES\System Restore.exe
  "C:\Program Files\Microsoft Games\Chess\es-ES\System Restore.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
  2⤵
  PID:2068
- C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\
  2⤵
  PID:2532
- - C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
    3⤵
    PID:1996
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
  2⤵
  PID:1988
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
  2⤵
  PID:1464
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\System Restore.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
  2⤵
  PID:2600
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
    3⤵
    PID:1932
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
      4⤵
      PID:2256
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
      4⤵
      PID:960
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
      4⤵
      PID:1752
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
      4⤵
      PID:2444
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
    3⤵
    PID:852

C:\Program Files\Microsoft Games\FreeCell\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
1⤵
PID:2880
- C:\Program Files\Microsoft Games\FreeCell\de-DE\System Restore.exe
  "C:\Program Files\Microsoft Games\FreeCell\de-DE\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
  2⤵
  PID:3008
- C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
  2⤵
  PID:1948
- C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
  2⤵
  PID:1696

C:\Program Files\Microsoft Games\Hearts\backup.exe
"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
1⤵
PID:2028
- C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
  2⤵
  PID:1416

C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
1⤵
PID:1092

C:\Program Files\Microsoft Games\Multiplayer\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
1⤵
PID:2716

C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
1⤵
PID:548

C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
1⤵
PID:2656

C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
1⤵
PID:2988

C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
1⤵
PID:2012

C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
1⤵
PID:2904

C:\Program Files\Microsoft Games\Purble Place\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\
1⤵
PID:2692
- C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
  2⤵
  PID:576
- C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
  2⤵
  PID:1924
- - C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\
    3⤵
    PID:572
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
  2⤵
  PID:1464
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\data.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\
    3⤵
    PID:2148
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
    3⤵
    PID:1304
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
    3⤵
    PID:2348
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\
      4⤵
      PID:1544
    - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
        5⤵
        
        PID:2264
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
        6⤵
        
        PID:2428
    - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
        5⤵
        
        PID:1588
    - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
        5⤵
        
        PID:320
    - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
        5⤵
        
        PID:1892
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\update.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\
      4⤵
      PID:2944
- C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\
  2⤵
  PID:1244
- - C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\update.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
    3⤵
    PID:1120
- C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\
  2⤵
  PID:1628
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
  2⤵
  PID:1588
- C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\
  2⤵
  PID:3016
- - C:\Program Files\Microsoft Office\Office14\1033\backup.exe
    "C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
    3⤵
    PID:2724
- C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
  2⤵
  PID:2572
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
  2⤵
  PID:2644
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
    3⤵
    PID:2488
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\
    3⤵
    PID:2816
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
    3⤵
    PID:1940
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\
    3⤵
    PID:2976
  - - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
      4⤵
      PID:3012
    - - C:\Program Files\Google\Chrome\backup.exe
        
        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
        5⤵
        
        PID:2796
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\
    3⤵
    PID:1128
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
    3⤵
    PID:3056
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
    3⤵
    PID:2968
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\
  2⤵
  PID:1252
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
    3⤵
    PID:2188
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\
    3⤵
    PID:2768
  - - C:\Program Files\Java\jre7\backup.exe
      "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
      4⤵
      PID:1668
  - - C:\Program Files\Java\jdk1.7.0_80\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
      4⤵
      PID:1656
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\
    3⤵
    PID:3008
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\
    3⤵
    PID:1944
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\System Restore.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\
    3⤵
    PID:800
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\
    3⤵
    PID:1668
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
  2⤵
  PID:2900
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\
    3⤵
    PID:2996
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\
    3⤵
    PID:2716
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
      4⤵
      PID:2328
    - - C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
        5⤵
        
        PID:952
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\data.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
        6⤵
        
        PID:2880
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
        6⤵
        
        PID:2308
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
        6⤵
        
        PID:1760
    - - C:\Program Files (x86)\Internet Explorer\ja-JP\System Restore.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\System Restore.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
        5⤵
        
        PID:1092
    - - C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
        5⤵
        
        PID:2836
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
    3⤵
    PID:1652
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\
    3⤵
    PID:896
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\
    3⤵
    PID:1748
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\
    3⤵
    PID:1712
- C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
  2⤵
  PID:2364
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
  2⤵
  PID:1956
- C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
  2⤵
  PID:2368
- C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\
  2⤵
  PID:2752
- C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
  2⤵
  PID:608
- C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
  2⤵
  PID:1952
- C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
  2⤵
  PID:2408
- C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\
  2⤵
  PID:2636
- C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
  2⤵
  PID:1648
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
    3⤵
    PID:2324
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
    3⤵
    PID:2312
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
    3⤵
    PID:1468
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
    3⤵
    PID:2716
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
      4⤵
      PID:1692
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\
      4⤵
      PID:1592
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
      4⤵
      PID:2604
- C:\Program Files (x86)\Common Files\microsoft shared\EURO\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EURO\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
  2⤵
  PID:2492
- C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
  2⤵
  PID:2292

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
1⤵
PID:1456

C:\Program Files\Microsoft Office\Office14\backup.exe
"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
1⤵
PID:3016

C:\Program Files\Mozilla Firefox\uninstall\backup.exe
"C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
1⤵
PID:3004
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
  2⤵
  PID:2824

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
1⤵
PID:1648
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
  2⤵
  PID:3000

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
1⤵
PID:284

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:1700

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\update.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:1804

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
1⤵
PID:1756

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
1⤵
PID:556

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System Restore.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
1⤵
PID:920

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:2224
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:2004
- - C:\Program Files (x86)\Google\CrashReports\backup.exe
    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
    3⤵
    PID:2940
- - C:\Program Files (x86)\Google\Temp\backup.exe
    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
    3⤵
    PID:1696
- - C:\Program Files (x86)\Google\Update\backup.exe
    "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
    3⤵
    PID:1160
  - - C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Google\Update\Download\backup.exe
      "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
      4⤵
      PID:2064
    - - C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
        5⤵
        
        PID:2412
  - - C:\Program Files (x86)\Google\Update\Install\backup.exe
      "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
      4⤵
      PID:2368
    - - C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
        5⤵
        
        PID:2080
  - - C:\Program Files (x86)\Google\Update\Offline\backup.exe
      "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
      4⤵
      PID:2516
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:2328
- - C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
    3⤵
    PID:2860
- - C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
    "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
    3⤵
    PID:2120
- - C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
    "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
    3⤵
    PID:2708
- - C:\Program Files (x86)\Internet Explorer\fr-FR\System Restore.exe
    "C:\Program Files (x86)\Internet Explorer\fr-FR\System Restore.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
    3⤵
    PID:1656
- C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
  2⤵
  PID:2156
- - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe
    "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\
    3⤵
    PID:2180
  - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe
      "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\
      4⤵
      PID:2268
    - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\
        5⤵
        
        PID:1304
    - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\
        5⤵
        
        PID:2368
      - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\
        6⤵
        
        PID:1668
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
      4⤵
      PID:2760
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
        5⤵
        
        PID:2580
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
      4⤵
      PID:548
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
      4⤵
      PID:2704
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\
        5⤵
        
        PID:2676
- C:\Program Files (x86)\Common Files\backup.exe
  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft Office\backup.exe
  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
  2⤵
  PID:576
- - C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe
    "C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\
    3⤵
    PID:556
  - - C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe
      "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe
      "C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\
      4⤵
      PID:872
    - - C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\update.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\update.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\
        5⤵
        
        PID:820
- - C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\
    3⤵
    PID:1308
  - - C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe
      "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe
      "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\
      4⤵
      PID:2752
- C:\Program Files (x86)\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System Restore.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
  "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
  2⤵
  PID:1264

C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
1⤵
PID:1944

C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
1⤵
PID:1940

C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
1⤵
PID:2252

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
1⤵
PID:912

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
1⤵
PID:996
- C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
  2⤵
  PID:348

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
1⤵
PID:2440

C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
1⤵
PID:992
- C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
  2⤵
  PID:1592

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
1⤵
PID:2160

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
1⤵
PID:2968

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
1⤵
PID:2844

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\
1⤵
PID:2584

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
1⤵
PID:864

C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
1⤵
PID:2304

C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
1⤵
PID:2796

C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
1⤵
PID:2844

C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
1⤵
PID:1512

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\
1⤵
PID:1836

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
1⤵
PID:2136

C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\
1⤵
PID:1720

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
1⤵
PID:1216

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
1⤵
PID:2984

C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\
1⤵
PID:2832

C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
1⤵
PID:1520

C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
1⤵
PID:2652

C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
1⤵
PID:1908

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
1⤵
PID:680

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
1⤵
PID:1632

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
1⤵
PID:2440

C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
1⤵
PID:2804
- C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
  2⤵
  PID:2424

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\
1⤵
PID:2136

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\
1⤵
PID:2384
- C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\
  2⤵
  PID:1552

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\
1⤵
PID:2620

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\
1⤵
PID:3032
- C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
  2⤵
  PID:2004

C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
1⤵
PID:2624

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
1⤵
PID:1588
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
  2⤵
  PID:2600
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
  2⤵
  PID:2608

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
1⤵
PID:2956

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\update.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
1⤵
PID:2656

C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
1⤵
PID:2704
- C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
  2⤵
  PID:1416
- C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\
  2⤵
  PID:2956
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
  2⤵
  PID:1500

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
1⤵
PID:2516
- C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\
  2⤵
  PID:1940
- - C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
    3⤵
    PID:1888

C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
1⤵
PID:2280

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
1⤵
PID:2848
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
  2⤵
  PID:2268

C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
1⤵
PID:292

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
1⤵
PID:2800

C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\
1⤵
PID:1648

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
1⤵
PID:2160

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\
1⤵
PID:1088
- C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
  2⤵
  PID:1724

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:2972
- C:\Users\Admin\backup.exe
  C:\Users\Admin\backup.exe C:\Users\Admin\
  2⤵
  PID:1264
- - C:\Users\Admin\Contacts\backup.exe
    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
    3⤵
    PID:2532
- - C:\Users\Admin\Downloads\backup.exe
    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
    3⤵
    PID:2112
- - C:\Users\Admin\Documents\backup.exe
    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
    3⤵
    PID:2268
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
      4⤵
      PID:2028
    - - C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
        5⤵
        
        PID:1020
    - - C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
        5⤵
        
        PID:2948
    - - C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
        5⤵
        
        PID:2268
    - - C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
        5⤵
        
        PID:2944
    - - C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
        5⤵
        
        PID:1420
- - C:\Users\Admin\Desktop\backup.exe
    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
    3⤵
    PID:2012
- - C:\Users\Admin\Favorites\backup.exe
    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
    3⤵
    PID:448
  - - C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
      4⤵
      PID:2136
- - C:\Users\Admin\Links\backup.exe
    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
    3⤵
    PID:1928
- - C:\Users\Admin\Pictures\backup.exe
    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
    3⤵
    PID:1704
- - C:\Users\Admin\Saved Games\backup.exe
    "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
    3⤵
    PID:1260
- - C:\Users\Admin\Music\backup.exe
    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
    3⤵
    PID:2788
- - C:\Users\Admin\Searches\data.exe
    C:\Users\Admin\Searches\data.exe C:\Users\Admin\Searches\
    3⤵
    PID:2540
- - C:\Users\Admin\Videos\backup.exe
    C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
    3⤵
    PID:2796
- C:\Users\Public\backup.exe
  C:\Users\Public\backup.exe C:\Users\Public\
  2⤵
  PID:1256
- - C:\Users\Public\Downloads\update.exe
    C:\Users\Public\Downloads\update.exe C:\Users\Public\Downloads\
    3⤵
    PID:2404
  - - C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
      4⤵
      PID:3060
- - C:\Users\Public\Music\backup.exe
    C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
    3⤵
    PID:1536
  - - C:\Users\Public\Music\Sample Music\backup.exe
      "C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\
      4⤵
      PID:1604
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
      4⤵
      PID:3056
- - C:\Users\Public\Recorded TV\backup.exe
    "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
    3⤵
    PID:268
  - - C:\Users\Public\Recorded TV\Sample Media\backup.exe
      "C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\
      4⤵
      PID:2472
- - C:\Users\Public\Pictures\backup.exe
    C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
    3⤵
    PID:2576
- - C:\Users\Public\Documents\backup.exe
    C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
    3⤵
    PID:2680
- - C:\Users\Public\Videos\backup.exe
    C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
    3⤵
    PID:2012
  - - C:\Users\Public\Videos\Sample Videos\backup.exe
      "C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\
      4⤵
      PID:2624
  - - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
      4⤵
      PID:2984
- - C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
    3⤵
    PID:2248

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2092
- C:\Program Files\Windows Defender\de-DE\backup.exe
  "C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
  2⤵
  PID:2476
- C:\Program Files\Windows Defender\en-US\backup.exe
  "C:\Program Files\Windows Defender\en-US\backup.exe" C:\Program Files\Windows Defender\en-US\
  2⤵
  PID:2116
- C:\Program Files\Windows Defender\es-ES\backup.exe
  "C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
  2⤵
  PID:2280
- C:\Program Files\Windows Defender\fr-FR\backup.exe
  "C:\Program Files\Windows Defender\fr-FR\backup.exe" C:\Program Files\Windows Defender\fr-FR\
  2⤵
  PID:1428
- C:\Program Files\Windows Defender\it-IT\backup.exe
  "C:\Program Files\Windows Defender\it-IT\backup.exe" C:\Program Files\Windows Defender\it-IT\
  2⤵
  PID:2196
- C:\Program Files\Windows Defender\ja-JP\backup.exe
  "C:\Program Files\Windows Defender\ja-JP\backup.exe" C:\Program Files\Windows Defender\ja-JP\
  2⤵
  PID:2256
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
    3⤵
    PID:1216
- C:\Program Files (x86)\Common Files\System\ado\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
  2⤵
  PID:2640
- - C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
    3⤵
    PID:1696
- - C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
    3⤵
    PID:2836
- - C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
    3⤵
    PID:2308
- - C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
    3⤵
    PID:2612
- - C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
    3⤵
    PID:3000
- - C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
    3⤵
    PID:2832
- - C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
    3⤵
    PID:2624

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
1⤵
PID:2256

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
1⤵
PID:2400

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
1⤵
PID:536
- C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
  2⤵
  PID:1236
- C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\
  2⤵
  PID:2188
- C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
  2⤵
  PID:2396
- C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
  2⤵
  PID:1928

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\
1⤵
PID:1712

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
1⤵
PID:1168
- C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\
  2⤵
  PID:1884
- C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
  2⤵
  PID:996
- C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
  2⤵
  PID:2112

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
1⤵
PID:1840

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
1⤵
PID:1764

C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\
1⤵
PID:2640

C:\Program Files\Windows Journal\data.exe
"C:\Program Files\Windows Journal\data.exe" C:\Program Files\Windows Journal\
1⤵
PID:2888
- C:\Program Files\Windows Journal\de-DE\data.exe
  "C:\Program Files\Windows Journal\de-DE\data.exe" C:\Program Files\Windows Journal\de-DE\
  2⤵
  PID:2672
- C:\Program Files\Windows Journal\en-US\data.exe
  "C:\Program Files\Windows Journal\en-US\data.exe" C:\Program Files\Windows Journal\en-US\
  2⤵
  PID:548
- C:\Program Files\Windows Journal\es-ES\backup.exe
  "C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
  2⤵
  PID:2832
- C:\Program Files\Windows Journal\fr-FR\backup.exe
  "C:\Program Files\Windows Journal\fr-FR\backup.exe" C:\Program Files\Windows Journal\fr-FR\
  2⤵
  PID:2552
- C:\Program Files\Windows Journal\Templates\backup.exe
  "C:\Program Files\Windows Journal\Templates\backup.exe" C:\Program Files\Windows Journal\Templates\
  2⤵
  PID:2436
- C:\Program Files\Windows Journal\ja-JP\backup.exe
  "C:\Program Files\Windows Journal\ja-JP\backup.exe" C:\Program Files\Windows Journal\ja-JP\
  2⤵
  PID:2800
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
    3⤵
    PID:2892
  - - C:\Windows\AppPatch\de-DE\backup.exe
      C:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\
      4⤵
      PID:700
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
    3⤵
    PID:2108
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
    3⤵
    PID:1648
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
    3⤵
    PID:2360

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\
1⤵
PID:1200
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
  2⤵
  PID:448
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
  2⤵
  PID:1888
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
  2⤵
  PID:2108
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
  2⤵
  PID:2824
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:1536
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
  2⤵
  PID:2544
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:3068
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
  2⤵
  PID:2748
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
  2⤵
  PID:3052
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
  2⤵
  PID:992
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\data.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
    3⤵
    PID:2292
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
    3⤵
    PID:2428
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\data.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
    3⤵
    PID:292
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
  2⤵
  PID:376
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
  2⤵
  PID:652
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
  2⤵
  PID:1308
- - C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\
    3⤵
    PID:2992
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
  2⤵
  PID:572
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
  2⤵
  PID:1892

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
1⤵
PID:1104

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
1⤵
PID:2476

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
1⤵
PID:2760

C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
1⤵
PID:2676

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
1⤵
PID:2044

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
1⤵
PID:2560

C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
1⤵
PID:1236

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\
1⤵
PID:1720

C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
1⤵
PID:2584

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
1⤵
PID:2028
- C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
  2⤵
  PID:2452
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
  2⤵
  PID:1636

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\update.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\
1⤵
PID:960

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
1⤵
PID:1680

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\
1⤵
PID:1456

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\
1⤵
PID:1748

C:\Program Files\Windows Mail\backup.exe
"C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\
1⤵
PID:652
- C:\Program Files\Windows Mail\de-DE\System Restore.exe
  "C:\Program Files\Windows Mail\de-DE\System Restore.exe" C:\Program Files\Windows Mail\de-DE\
  2⤵
  PID:1636
- C:\Program Files\Windows Mail\en-US\backup.exe
  "C:\Program Files\Windows Mail\en-US\backup.exe" C:\Program Files\Windows Mail\en-US\
  2⤵
  PID:576
- C:\Program Files\Windows Mail\es-ES\backup.exe
  "C:\Program Files\Windows Mail\es-ES\backup.exe" C:\Program Files\Windows Mail\es-ES\
  2⤵
  PID:1772
- - C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
    3⤵
    PID:1152
- C:\Program Files\Windows Mail\it-IT\System Restore.exe
  "C:\Program Files\Windows Mail\it-IT\System Restore.exe" C:\Program Files\Windows Mail\it-IT\
  2⤵
  PID:2924
- C:\Program Files\Windows Mail\fr-FR\backup.exe
  "C:\Program Files\Windows Mail\fr-FR\backup.exe" C:\Program Files\Windows Mail\fr-FR\
  2⤵
  PID:1216
- C:\Program Files\Windows Mail\ja-JP\backup.exe
  "C:\Program Files\Windows Mail\ja-JP\backup.exe" C:\Program Files\Windows Mail\ja-JP\
  2⤵
  PID:2116

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\
1⤵
PID:1652

C:\Program Files (x86)\Google\Update\Install\{1187FFC4-7B4C-4060-83CA-88C53EC9AD16}\backup.exe
"C:\Program Files (x86)\Google\Update\Install\{1187FFC4-7B4C-4060-83CA-88C53EC9AD16}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{1187FFC4-7B4C-4060-83CA-88C53EC9AD16}\
1⤵
PID:3012
- C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
  2⤵
  PID:2516

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\
1⤵
PID:2992

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\
1⤵
PID:1776

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\
1⤵
PID:1796

C:\Users\Public\Pictures\Sample Pictures\backup.exe
"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
1⤵
PID:3024

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\
1⤵
PID:3060
- C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
  2⤵
  PID:2852

C:\Windows\update.exe
C:\Windows\update.exe C:\Windows\
1⤵
PID:2888
- C:\Program Files\Windows Journal\it-IT\backup.exe
  "C:\Program Files\Windows Journal\it-IT\backup.exe" C:\Program Files\Windows Journal\it-IT\
  2⤵
  PID:844
- C:\Windows\addins\backup.exe
  C:\Windows\addins\backup.exe C:\Windows\addins\
  2⤵
  PID:2816
- - C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
    "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
    3⤵
    PID:1520

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\
1⤵
PID:1468

C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
1⤵
PID:2216
- C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
  2⤵
  PID:2092
- - C:\Program Files (x86)\Common Files\System\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\
    3⤵
    PID:2220
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
      4⤵
      PID:1100
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
      4⤵
      PID:2392
- - C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\
    3⤵
    PID:2552
- - C:\Program Files (x86)\Common Files\System\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\
    3⤵
    PID:3020
- - C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
    3⤵
    PID:2540
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
      4⤵
      PID:2536
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
      4⤵
      PID:820
- - C:\Program Files (x86)\Common Files\System\msadc\backup.exe
    "C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\
    3⤵
    PID:2488
  - - C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe
      "C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe
      "C:\Program Files (x86)\Common Files\System\msadc\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\en-US\
      4⤵
      PID:1784
- - C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe
    "C:\Program Files (x86)\Common Files\System\MSMAPI\backup.exe" C:\Program Files (x86)\Common Files\System\MSMAPI\
    3⤵
    PID:2784
- - C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe
    "C:\Program Files (x86)\Common Files\System\Ole DB\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\
    3⤵
    PID:1160

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
1⤵
PID:1736
- C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
  2⤵
  PID:1244

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
1⤵
PID:592

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
1⤵
PID:276

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
1⤵
PID:1540

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
1⤵
PID:2948

C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\
1⤵
PID:2332

C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
1⤵
PID:2616

C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\
1⤵
PID:1728

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
1⤵
PID:852
- C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
  2⤵
  PID:2756

C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
1⤵
PID:1640
- C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
  2⤵
  PID:2780
- C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
  2⤵
  PID:2920
- C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
  2⤵
  PID:2196
- C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
  2⤵
  PID:2412
- C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
  2⤵
  PID:576
- - C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe
    "C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft Office\Office14\backup.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\
    3⤵
    PID:1508
- C:\Program Files\Java\jre7\lib\zi\America\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
  2⤵
  PID:1168

C:\Program Files\Windows Media Player\backup.exe
"C:\Program Files\Windows Media Player\backup.exe" C:\Program Files\Windows Media Player\
1⤵
PID:1956
- C:\Program Files\Windows Media Player\de-DE\backup.exe
  "C:\Program Files\Windows Media Player\de-DE\backup.exe" C:\Program Files\Windows Media Player\de-DE\
  2⤵
  PID:572
- C:\Program Files\Windows Media Player\en-US\backup.exe
  "C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
  2⤵
  PID:2408
- C:\Program Files\Windows Media Player\es-ES\backup.exe
  "C:\Program Files\Windows Media Player\es-ES\backup.exe" C:\Program Files\Windows Media Player\es-ES\
  2⤵
  PID:1948
- C:\Program Files\Windows Media Player\fr-FR\backup.exe
  "C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
  2⤵
  PID:1244
- C:\Program Files\Windows Media Player\it-IT\backup.exe
  "C:\Program Files\Windows Media Player\it-IT\backup.exe" C:\Program Files\Windows Media Player\it-IT\
  2⤵
  PID:2680
- C:\Program Files\Windows Media Player\ja-JP\backup.exe
  "C:\Program Files\Windows Media Player\ja-JP\backup.exe" C:\Program Files\Windows Media Player\ja-JP\
  2⤵
  PID:2628
- C:\Program Files\Windows Media Player\Media Renderer\backup.exe
  "C:\Program Files\Windows Media Player\Media Renderer\backup.exe" C:\Program Files\Windows Media Player\Media Renderer\
  2⤵
  PID:2160
- C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
  2⤵
  PID:2760
- C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
  2⤵
  PID:2476
- C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
  2⤵
  PID:2296
- C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
  2⤵
  PID:2524
- C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
  2⤵
  PID:2356

C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
1⤵
PID:972

C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
1⤵
PID:1020

C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
1⤵
PID:1796

C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
1⤵
PID:2476

C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
1⤵
PID:952

C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\
1⤵
PID:2552

C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\
1⤵
PID:2748

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
1⤵
PID:1588

C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
1⤵
PID:704

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
1⤵
PID:820

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
1⤵
PID:844

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
1⤵
PID:1796

C:\Program Files\VideoLAN\VLC\backup.exe
"C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
1⤵
PID:624
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
  2⤵
  PID:896
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
  2⤵
  PID:1660

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:1668

C:\Program Files\Windows NT\backup.exe
"C:\Program Files\Windows NT\backup.exe" C:\Program Files\Windows NT\
1⤵
PID:2860
- C:\Program Files\Windows NT\Accessories\backup.exe
  "C:\Program Files\Windows NT\Accessories\backup.exe" C:\Program Files\Windows NT\Accessories\
  2⤵
  PID:2976
- - C:\Program Files\Windows NT\Accessories\de-DE\backup.exe
    "C:\Program Files\Windows NT\Accessories\de-DE\backup.exe" C:\Program Files\Windows NT\Accessories\de-DE\
    3⤵
    PID:348
- - C:\Program Files\Windows NT\Accessories\en-US\backup.exe
    "C:\Program Files\Windows NT\Accessories\en-US\backup.exe" C:\Program Files\Windows NT\Accessories\en-US\
    3⤵
    PID:2648
- - C:\Program Files\Windows NT\Accessories\es-ES\backup.exe
    "C:\Program Files\Windows NT\Accessories\es-ES\backup.exe" C:\Program Files\Windows NT\Accessories\es-ES\
    3⤵
    PID:1020
- - C:\Program Files\Windows NT\Accessories\fr-FR\backup.exe
    "C:\Program Files\Windows NT\Accessories\fr-FR\backup.exe" C:\Program Files\Windows NT\Accessories\fr-FR\
    3⤵
    PID:2272
- - C:\Program Files\Windows NT\Accessories\it-IT\backup.exe
    "C:\Program Files\Windows NT\Accessories\it-IT\backup.exe" C:\Program Files\Windows NT\Accessories\it-IT\
    3⤵
    PID:652
  - - C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
      4⤵
      PID:2404
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\update.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
        5⤵
        
        PID:964
  - - C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
      4⤵
      PID:3040
  - - C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
      4⤵
      PID:1776
- - C:\Program Files\Windows NT\Accessories\ja-JP\backup.exe
    "C:\Program Files\Windows NT\Accessories\ja-JP\backup.exe" C:\Program Files\Windows NT\Accessories\ja-JP\
    3⤵
    PID:1752
- C:\Program Files\Windows NT\TableTextService\backup.exe
  "C:\Program Files\Windows NT\TableTextService\backup.exe" C:\Program Files\Windows NT\TableTextService\
  2⤵
  PID:2552

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:2548

C:\Program Files\MSBuild\Microsoft\backup.exe
"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
1⤵
PID:1784

C:\Program Files\MSBuild\backup.exe
"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
1⤵
PID:2744

C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
1⤵
PID:1264

C:\Program Files\Mozilla Firefox\fonts\backup.exe
"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
1⤵
PID:2296

C:\Program Files\Mozilla Firefox\defaults\backup.exe
"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
1⤵
PID:1596

C:\Program Files\Mozilla Firefox\browser\backup.exe
"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
1⤵
PID:2532

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:1084

C:\Program Files\Microsoft Office\backup.exe
"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
1⤵
PID:1680

C:\Program Files\Microsoft Games\Solitaire\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
1⤵
PID:536

C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
1⤵
PID:1888
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
  2⤵
  PID:2892
- - C:\Windows\AppPatch\en-US\backup.exe
    C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
    3⤵
    PID:2624

C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\
1⤵
PID:1704

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\System Restore.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\System Restore.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
1⤵
PID:2824

C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
1⤵
PID:1120
- C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\
  2⤵
  PID:1984
- C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
  2⤵
  PID:2428

C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
1⤵
PID:2348

C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
1⤵
PID:1972
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
  2⤵
  PID:1236

C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
1⤵
PID:348

C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
1⤵
PID:1820

C:\Program Files\Microsoft Games\backup.exe
"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
1⤵
PID:3052

C:\Program Files\Windows Photo Viewer\backup.exe
"C:\Program Files\Windows Photo Viewer\backup.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:1520
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
  2⤵
  PID:952
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
    3⤵
    PID:2488
  - - C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe
      "C:\Program Files (x86)\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\es-ES\
      4⤵
      PID:872

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
1⤵
PID:2492
- C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
  2⤵
  PID:1884

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\
1⤵
PID:1884
- C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
  2⤵
  PID:2860
- C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
  2⤵
  PID:2920
- C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
  2⤵
  PID:1112
- C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
  2⤵
  PID:652
- C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
  2⤵
  PID:2396
- C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
  2⤵
  PID:1892
- C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
  2⤵
  PID:624
- C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
  2⤵
  PID:1464
- C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
  2⤵
  PID:2352
- C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
  2⤵
  PID:2064
- C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
  2⤵
  PID:1908
- C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
  2⤵
  PID:1160
- C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
  2⤵
  PID:2240

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
1⤵
PID:1624

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
1⤵
PID:3044

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
1⤵
PID:1092

C:\Program Files\Windows Portable Devices\backup.exe
"C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
1⤵
PID:1616

C:\Program Files\Java\data.exe
"C:\Program Files\Java\data.exe" C:\Program Files\Java\
1⤵
PID:2768

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:1700

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:2820

C:\Program Files\Windows Sidebar\backup.exe
"C:\Program Files\Windows Sidebar\backup.exe" C:\Program Files\Windows Sidebar\
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
59KB

MD5
0d4f88b343aaeb8a6b70136e0e398eb7

SHA1
076ff1d06411d310dad54663af87773e90f83917

SHA256
04ab31679af354b5248f317cf5a85f84f450b18a7d3b8afdf2bed4cabb9823ec

SHA512
0f24853681895438bac03c6b740d24135bb76c502159ec1249778c3164211395d9fb98a99638e373ba138d0a3167f8ae539e08daabafe59bcf75f706cd0f284a

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
47KB

MD5
b5e450ea58c6df6ca59e95f870bb7a3d

SHA1
dfa5b899769bc336d689b4920c150b668eec0e0a

SHA256
917ec8a40aa368606ba4d8db1f16989b40bb08887cb177b114b34f5a7c30fa58

SHA512
da19731980b35ebc51b6d6c35a229389043bc5dc7f68058514db1bac106945e789158f0c1daf98d93f941ae9481e81f61ba8fa3c24a328af2bd9a3505bde0ea6

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
67KB

MD5
d7bc0e2a15aeeeedf986025cb48313e8

SHA1
370425301bf52f675efd3f117c943a6b30fa87eb

SHA256
a7fd153b99275368f374d4f2e974108cbf8ebba364d24359bf565eae53371eab

SHA512
ebf6fe4ad0b13a4b6dbfd6f527c851a1d27ec3e7572666ffcb6f761092f10c4d579918c3bea656b501801c69177510968c338bce7dad87d08a7a7676e0dfc702

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
6f96dd3482fe1da26cd92405504903af

SHA1
9ee30b05cb4f57125b1748bd86d505fbb6d60509

SHA256
2e1eca417b5fdbfdd50c415681903cfdffbf4dba1ebf5f1c16c7fe7d35dbb39f

SHA512
a5ea24d96a5ea5e114858fbd2c05d6e67ab8d17943d4965866d3382f6ba7b42a310050c8de87bd89e03d5b7203f45b369ebbeba341281d25fc8d313239a47466

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
25KB

MD5
4922b5ce72e6d5374d2b129cc4c43e29

SHA1
2ed88c3223553df91d994a4baf6f293bb3a241b7

SHA256
af8fc5fb9dad995f71ed1a88d12cc5e4ed66565fecaf2c6b20dc100edfda2fee

SHA512
bf3a8023d2ee6becd3153cf65bcd99bd4a28b14de59507e068cee966f17c030d0f7f328a24dd5f12454a476e6b1afe28d90d8457ebc2d6d2c3550f557e6eb6e6

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
811d7b8a3baa33b3c68f7123beaccfa8

SHA1
6f5edc5f06897899a8464f467a7bb407216ff325

SHA256
b207ff496fc9fb9e5e4dc62532f8b1a96f2e0003bd102a61738a751125d122c4

SHA512
b9ed8d0b505d3bff9f170aed04fb34ce564e4cc4b24c1f7a6e27adead5857095c770498ea7bd397423cf56d22bf00b9e9b7ad1b6c8e1ad8be8fff2c70ec8db36

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
72d2d07e273436435c37ff94a854234e

SHA1
aab252f49e23e1999874002bdd4d940bfd4b0e1b

SHA256
4cfc1ae11bacf2626e39d0fccf26c5a312ecc9f4946917b3b36135a69cef8f1a

SHA512
72e05a9dbf39bc40885892aca83b2433451c993caa6eea64f0ac911c6edbac6a253f93cc419c25343bfe4d49da7c812be5714cb38c4cc881e4d4370c8766030e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
8KB

MD5
59e866e4e8d5414fdc2916f78d6caaea

SHA1
7091c011cece785c9e22bb530682f4c79011d505

SHA256
3febbe9c8d7282adfc3fdb148e22e59c96cd9280dc00a580d4f41f7e6f1d947d

SHA512
5664b8d6b0d2d16f238695ee29c431d59bde59c45380d5189dcedf1c8c92c21ae96733d2e58250dc4128949703d66ec9896d841d394908216493dfe5033ac9ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe

Filesize
39KB

MD5
e21a70ee50917e0df486b34f1ec4fbfa

SHA1
4fc8874f02a9fdeb2ad65f0f6f7e08a16fc883e4

SHA256
0c929759e6e5cbecf573695f439bf42879f5ee4ecad5f06c1ec65e351a272f5e

SHA512
e43d4fd343a19efc343c1c2c9e69d0dada5e020c0c6233155a0ed495b07a3b3ae91acb3d6aa6b56a0423395b570c5b9fa56259c4a997a12d8e2702d35d9cc45d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
50KB

MD5
bfad89883f80abf5ec36583906c95da4

SHA1
7fe74da8d1df00738e6e81e75e86298bbbe8ee19

SHA256
d14ab471eb226361ef2b0b45d256701a489a2fc1629c36fbb2b9431829644607

SHA512
acd413e87151572fda6a385abe0ca79dd780a41d30299c013412b26ccebfc2aded80b96bcc1c538e41eb71473adb68abc7bc3138fb8857a69f020f552b7adf3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
71KB

MD5
5d59b46e6cea71f9a1ed34e5e9efb8cb

SHA1
d4ac5ba0722eefa68576289281e07f32446e6953

SHA256
14ef750a4d08e11e1243a8b4eaaa6de38d02abcb1cbd2ea5e2190f5fdaa82b80

SHA512
a450dfff36492ecbe09294c0eebbf9bb6245c5ff91c8c2ee95a0d2db001542f5a9e4f4cd175e3328a8396410e8e5fc3d35346838d51391c1c5f63efe5d6f8ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
20KB

MD5
ddc6f7d80f32c96343d0ace08e5f82c0

SHA1
4607dfc52b40303d04d0233e4b460a1ee3caf1b5

SHA256
813eccfbee4a7d1e8c5fcf77198e88fd36d8ac0969c8247a59a76475570a00cb

SHA512
33af115b6a68581d0ef5c2d7de27b3472ef20dfb3598bb33cbc3184c29271679b89aa6f3dc34b03103c037a2d8d328181c78dc1534a4cd817ed4fa713651fd73

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
017f901ed52fe698ea8fa537f50ccb58

SHA1
fde4711c37d9fce0da778d3df151a8ee038bea7f

SHA256
1310990c0ec05e736a9bb777a04227b083b462e48c30d81691a8a36638225253

SHA512
6cfee813223f1996d3e7b6012a1ab566953fc16e00da6a3b2398fd29aea9e36834b446c8501f688ae346feab332bccb226db6b33b03cb068bd8d3dc7c8e2bbe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\backup.exe

Filesize
72KB

MD5
960cd4391de4195687c62682b5fdbdae

SHA1
a6f24a17c11cd2c40c9e80814f2280442c9f7417

SHA256
1e708858c6a14aa78cd32290c1ca24461b5310222c21cf817f9158c978d7da69

SHA512
6a33b29b162cfa87ebb3ef7663d753f407f6451cdcae28d6f0a8a89e9a4b744386b162f431ab794a4c30a276a9aafbd8b3d61816741d59ed33273bebd92d029c

Download Submit
C:\backup.exe

Filesize
26KB

MD5
6c5a5daefc6183d69077d84fe179f0f3

SHA1
15aaa566dcb0505c9672d47e8dd07d4a873a60e8

SHA256
f0d6e0b5ab0a4123725109423e82e65c3b8ad1c591634db62736400553edbc6d

SHA512
a1272a12f9b1a0757b95853fa28735674fa00d2e7da9aa93d167f19baaf80baf3fc81d8b798d8336329d46aac9cf4220f0fb1b874d5edebebeaf86507fc3f18f

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
72KB

MD5
6d3afbfdafe52c243d6e6ae1e1376c6b

SHA1
53758cda6344ef36d1b3361fa1cccc476a846cd0

SHA256
3a16dd68c0eb33ad34b691ac12597ee413d12d83e2495cd4b5fb7ac110782e54

SHA512
2d6223d761fb6e671f240667c7a52911eb8479234ac134cc81434444d545886375ae03743a03373c7ea88e71f0e8ebf58d10281735f031fd0020d39cdd2d7e92

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\update.exe

Filesize
72KB

MD5
1d3edca761bd9580cfc0f8b6a1f627fd

SHA1
be04082e6f82073fc2a443912eed75f3e97ce393

SHA256
8ce777aab8eeb5a0896532682057490062d5d01380f7123d95676ed87c9ec80a

SHA512
a42382c8d5f5b8431ab08c39cbb0d4202246971ef39a178e800e141a42e0e26796098c04860c612700832fe5a2ee26d24fe424b4875881b4748d571b6cf42819

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\update.exe

Filesize
21KB

MD5
76961fac1dadd7ff1f6e47ce5b333431

SHA1
fed199e84dee48384fb330b865d85ea2972fe208

SHA256
66dbcbf8600ef984b1295013d748a73b7124b6f1a3dee5026ee731bf9821acf8

SHA512
651d711ef553e208e4d8b193432d82d3f2dff40e395bce4990d5d48784ba27484fdb7d0ff96b237c4268a7e0beaf643e15d213dde1dd0dedbcf809c4b02737b1

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
72KB

MD5
ae66b02cab60c1be35b5ae7698ff36c3

SHA1
a8f2c31c5eaa6e7dda83822864c5a17b48e05faa

SHA256
1109e802cfb57ec3271bafc545a93af0bcdde6cc5dea00ea8590c0a875c81444

SHA512
d58e079dfa458f97e6537c0744eed4f870de42f3c469eca2bea3a9ab02e9cf8ab7094989655b543ff6c8d2eea7d8db4fe296ae85cd097bbe9ac8be8ec5a0800d

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
58KB

MD5
2a1e64cc67c69760a83cbb43b02de8b0

SHA1
edb3088f7fe19c2fc155cc4ac1dd226db5899e61

SHA256
89675e2acee25a284dad4e752e06a670b379b3eac22c6bd010560e6777681fd4

SHA512
66b9f56f52d9573163f4f82dcba68b691cf110197999993fd5a5f137cd601f4d37c972ddfb8287d04f610e80335be216d6e24ed7549138361a495fb6f9d8cf11

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
1KB

MD5
e63a7c029300ad9025a6af766763f65c

SHA1
f9c0f5ac4786af176b0f7d9fe6556a9d4226159a

SHA256
3604434e4961435adc19ab5a701472e4f7f8e8b4eabee26e128d795310b408b6

SHA512
2510bfee2e4d2a7e6641512b3bd4c6f7feb8ad9e94649ac9de85fae612f8cd43cfc57b620c9154802b105af356db9d07894ed122d745ebeb9d08f2339b9eb930

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
33KB

MD5
efcd29e56973c7186d77dd56be681802

SHA1
2bd2370cf68327d935beb02ec476810ee59aee17

SHA256
98a7b03426f40afd27a6d7cb58d62a0de001357957f0bcc5a26856bb2f22ce1a

SHA512
3c8847607718a43f2c83ef054330e2b89946148aea5c8fff9c239f5c6e27defa00a4d05cc49c7f44f24ab50efe89320cd13945e33816d03573af5f66b6003926

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
40KB

MD5
448b8a038ad40e81c2f09cce28f7d034

SHA1
55ae0a06f7332efcae3a0e9066f7706ef1f424f7

SHA256
11a7f7756c54165763556110b04f3325d6094b9051b11e16829c779b0b15a135

SHA512
b97dabed99e09b6e55443d9ea6f7681c580cc08508470406704d521247c5fed8f7a652094d9a2e2b11d1cbcb488df583e93e5f04dd15931db1696fc35338fb2c

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
22KB

MD5
644968a58cdd28c387df16ad96674cbc

SHA1
d907549217037f55207a14d04dd57df8fde5b3b3

SHA256
88d3bb2de63db45364eca7faeb061a9a4b1b76ee1ba362b12df632023960435b

SHA512
4159b69a2090c73c55864d28192c7df9b84f9cc3c65f63a0876f7eb01b084ab36af3b7f1a88f57531c5262878cfeb11e9bfb103ecf7a797634809d997052c8a9

Download Submit
memory/2324-3722-0x0000000002A10000-0x0000000002B20000-memory.dmp

Filesize
1.1MB

Download
memory/2420-80-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads