12dc0aa9dfe5df17ec8df756276e9838a8cf7b40db742ddd87404c80385f2422

Analysis

max time kernel
1s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e8c7fcd3dcf47b1d9d4e7027a0dcffb.exe
Size

72KB
MD5

3e8c7fcd3dcf47b1d9d4e7027a0dcffb
SHA1

4cf5317574f83f343381340bc9ced28e7e663e55
SHA256

12dc0aa9dfe5df17ec8df756276e9838a8cf7b40db742ddd87404c80385f2422
SHA512

aee524db6f17ed0b949166330ce0164a455971da3d930ccb28013e0a26ac370ac2f5dc06c2fb2b18cd82ab8c074a905a2619024ac520559274e695896bf97c33
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2b:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr3

Score

1^/10

Malware Config

Signatures

C:\Users\Admin\AppData\Local\Temp\3e8c7fcd3dcf47b1d9d4e7027a0dcffb.exe
"C:\Users\Admin\AppData\Local\Temp\3e8c7fcd3dcf47b1d9d4e7027a0dcffb.exe"
1⤵
PID:2112
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:940
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:2576
- - C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
    3⤵
    PID:1744
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  PID:2584

C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
1⤵
PID:1848
- C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
  2⤵
  PID:1892

C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
1⤵
PID:1900

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:1852

C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
1⤵
PID:1456

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
1⤵
PID:1112
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
  2⤵
  PID:1740
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
  2⤵
  PID:1668
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
  2⤵
  PID:2600
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
  2⤵
  PID:2656

C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
1⤵
PID:2504

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
1⤵
PID:2984
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
  2⤵
  PID:2488
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
    3⤵
    PID:2688
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
    3⤵
    PID:1996
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
      4⤵
      PID:1444
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\
      4⤵
      PID:2196
  - - C:\Program Files\Microsoft Games\Chess\de-DE\update.exe
      "C:\Program Files\Microsoft Games\Chess\de-DE\update.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
      4⤵
      PID:3020
  - - C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
      4⤵
      PID:2356
  - - C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\
      4⤵
      PID:3000
  - - C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
      4⤵
      PID:892
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
        5⤵
        
        PID:2652
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
        5⤵
        
        PID:2364
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\update.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
        6⤵
        
        PID:568
  - - C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
      4⤵
      PID:2364
  - - C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
      4⤵
      PID:640
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
    3⤵
    PID:1132
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
    3⤵
    PID:1720

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
1⤵
PID:2928

C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
1⤵
PID:1184

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
1⤵
PID:1212

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
1⤵
PID:1548

C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
1⤵
PID:2084

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
1⤵
PID:584

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
1⤵
PID:2296

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
1⤵
PID:2244

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
1⤵
PID:1916

C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
1⤵
PID:2036

C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
1⤵
PID:1132
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\
  2⤵
  PID:1724
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\System Restore.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
    3⤵
    PID:892
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\update.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
      4⤵
      PID:804
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
      4⤵
      PID:3012
    - - C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
        5⤵
        
        PID:1096
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
      4⤵
      PID:2636
    - - C:\Program Files\Mozilla Firefox\uninstall\data.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\data.exe" C:\Program Files\Mozilla Firefox\uninstall\
        5⤵
        
        PID:2472
    - - C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
        5⤵
        
        PID:1772
      - C:\Program Files\Windows Mail\de-DE\backup.exe
        
        "C:\Program Files\Windows Mail\de-DE\backup.exe" C:\Program Files\Windows Mail\de-DE\
        6⤵
        
        PID:1792
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
        7⤵
        
        PID:2692
      - C:\Program Files\Windows Mail\en-US\backup.exe
        
        "C:\Program Files\Windows Mail\en-US\backup.exe" C:\Program Files\Windows Mail\en-US\
        6⤵
        
        PID:1828
      - C:\Program Files\Windows Mail\es-ES\backup.exe
        
        "C:\Program Files\Windows Mail\es-ES\backup.exe" C:\Program Files\Windows Mail\es-ES\
        6⤵
        
        PID:1096
      - C:\Program Files\Windows Mail\fr-FR\backup.exe
        
        "C:\Program Files\Windows Mail\fr-FR\backup.exe" C:\Program Files\Windows Mail\fr-FR\
        6⤵
        
        PID:2564
      - C:\Program Files\Windows Mail\it-IT\backup.exe
        
        "C:\Program Files\Windows Mail\it-IT\backup.exe" C:\Program Files\Windows Mail\it-IT\
        6⤵
        
        PID:284
    - - C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
        5⤵
        
        PID:2084
    - - C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
        5⤵
        
        PID:1776
    - - C:\Program Files\Microsoft Games\Mahjong\en-US\update.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\en-US\update.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
        5⤵
        
        PID:2072
    - - C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
        5⤵
        
        PID:2500
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\
      4⤵
      PID:2740
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
  2⤵
  PID:2652
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
    3⤵
    PID:1212
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
  2⤵
  PID:2564

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
1⤵
PID:2356

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:1720
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
  2⤵
  PID:1716
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\System Restore.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
    3⤵
    PID:1296
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
  2⤵
  PID:1792
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
  2⤵
  PID:1776
- - C:\Program Files\Microsoft Office\Office14\1033\update.exe
    "C:\Program Files\Microsoft Office\Office14\1033\update.exe" C:\Program Files\Microsoft Office\Office14\1033\
    3⤵
    PID:2620
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
  2⤵
  PID:484
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
  2⤵
  PID:2408

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
1⤵
PID:2668

C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\data.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
1⤵
PID:2732

C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
1⤵
PID:2920

C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\update.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
1⤵
PID:2492

C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:2500

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:1484

C:\Program Files\Common Files\System\ado\fr-FR\update.exe
"C:\Program Files\Common Files\System\ado\fr-FR\update.exe" C:\Program Files\Common Files\System\ado\fr-FR\
1⤵
PID:2428

C:\Program Files\Common Files\System\ja-JP\backup.exe
"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
1⤵
PID:936

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
1⤵
PID:892

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
1⤵
PID:1580

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
1⤵
PID:1360

C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
1⤵
PID:2552

C:\Program Files\Common Files\System\Ole DB\backup.exe
"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
1⤵
PID:2676
- C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
  2⤵
  PID:2844
- C:\Program Files\Common Files\System\Ole DB\es-ES\System Restore.exe
  "C:\Program Files\Common Files\System\Ole DB\es-ES\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
  2⤵
  PID:2684
- C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
  2⤵
  PID:2772
- C:\Program Files\Common Files\System\Ole DB\it-IT\data.exe
  "C:\Program Files\Common Files\System\Ole DB\it-IT\data.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
  2⤵
  PID:1164
- C:\Program Files\Common Files\System\Ole DB\fr-FR\update.exe
  "C:\Program Files\Common Files\System\Ole DB\fr-FR\update.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
  2⤵
  PID:1224
- C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
  2⤵
  PID:2912

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:2724

C:\Program Files\DVD Maker\es-ES\backup.exe
"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
1⤵
PID:1196

C:\Program Files\DVD Maker\fr-FR\backup.exe
"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
1⤵
PID:2012

C:\Program Files\DVD Maker\ja-JP\backup.exe
"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
1⤵
PID:1776

C:\Program Files\DVD Maker\Shared\backup.exe
"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
1⤵
PID:2820
- C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
  2⤵
  PID:2204
- - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
    3⤵
    PID:1092
- - C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\update.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
    3⤵
    PID:2752
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
    3⤵
    PID:2148
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
    3⤵
    PID:408
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
    3⤵
    PID:2288
  - - C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
      4⤵
      PID:1844
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
    3⤵
    PID:2424
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
    3⤵
    PID:2256
  - - C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
      4⤵
      PID:2644
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\System Restore.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
    3⤵
    PID:1924
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
    3⤵
    PID:1620
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
    3⤵
    PID:1452

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:2380

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
1⤵
PID:2968
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
  2⤵
  PID:2764
- - C:\Program Files\VideoLAN\VLC\backup.exe
    "C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
    3⤵
    PID:2356
  - - C:\Program Files\VideoLAN\VLC\locale\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
      4⤵
      PID:2604
    - - C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
        5⤵
        
        PID:2492
      - C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
        6⤵
        
        PID:2724
    - - C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
        5⤵
        
        PID:2620
    - - C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
        5⤵
        
        PID:2856
    - - C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
        5⤵
        
        PID:2596
      - C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
        6⤵
        
        PID:2608
    - - C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
        5⤵
        
        PID:1208
      - C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
        6⤵
        
        PID:2532
        
        C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
        7⤵
        
        PID:2588
    - - C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\
        5⤵
        
        PID:2124
      - C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
        6⤵
        
        PID:1904
        
        C:\Program Files\Windows Journal\en-US\backup.exe
        
        "C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
        7⤵
        
        PID:2520
        
        C:\Program Files\Windows Journal\es-ES\backup.exe
        
        "C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
        7⤵
        
        PID:3008
        
        C:\Program Files\Windows Journal\fr-FR\backup.exe
        
        "C:\Program Files\Windows Journal\fr-FR\backup.exe" C:\Program Files\Windows Journal\fr-FR\
        7⤵
        
        PID:1716
        
        C:\Program Files\Windows Journal\it-IT\backup.exe
        
        "C:\Program Files\Windows Journal\it-IT\backup.exe" C:\Program Files\Windows Journal\it-IT\
        7⤵
        
        PID:2556
        
        C:\Program Files\Windows Journal\ja-JP\backup.exe
        
        "C:\Program Files\Windows Journal\ja-JP\backup.exe" C:\Program Files\Windows Journal\ja-JP\
        7⤵
        
        PID:2332
    - - C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
        5⤵
        
        PID:2352
      - C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
        6⤵
        
        PID:2176
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
        7⤵
        
        PID:1568
    - - C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
        5⤵
        
        PID:1744
      - C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
        6⤵
        
        PID:2972
    - - C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
        5⤵
        
        PID:2308
    - - C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
        5⤵
        
        PID:2036
      - C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
        6⤵
        
        PID:1692
    - - C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\
        5⤵
        
        PID:2924
    - - C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
        5⤵
        
        PID:2448
      - C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\System Restore.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
        6⤵
        
        PID:1660
    - - C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\
        5⤵
        
        PID:2180
    - - C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
        5⤵
        
        PID:932
    - - C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
        5⤵
        
        PID:2428
      - C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
        6⤵
        
        PID:2432
    - - C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
        5⤵
        
        PID:1924
      - C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
        6⤵
        
        PID:2908
    - - C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\
        5⤵
        
        PID:2540
      - C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
        6⤵
        
        PID:2856
        
        C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
        7⤵
        
        PID:2832
    - - C:\Program Files\VideoLAN\VLC\locale\he\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\
        5⤵
        
        PID:1728
      - C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
        6⤵
        
        PID:2608
    - - C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
        5⤵
        
        PID:2836
      - C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
        6⤵
        
        PID:1164
    - - C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
        5⤵
        
        PID:1772
      - C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
        6⤵
        
        PID:1700
      - C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
        6⤵
        
        PID:1036
    - - C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
        5⤵
        
        PID:1912
      - C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
        6⤵
        
        PID:1640
    - - C:\Program Files\VideoLAN\VLC\locale\ja\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ja\update.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
        5⤵
        
        PID:1056
      - C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
        6⤵
        
        PID:1636
    - - C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\
        5⤵
        
        PID:2080
      - C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
        6⤵
        
        PID:2684
    - - C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\
        5⤵
        
        PID:2576
    - - C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
        5⤵
        
        PID:2620
      - C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
        6⤵
        
        PID:2776
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
        7⤵
        
        PID:2508
      - C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
        6⤵
        
        PID:932
    - - C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\
        5⤵
        
        PID:2744
      - C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
        6⤵
        
        PID:1732
    - - C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
        5⤵
        
        PID:2596
      - C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\
        6⤵
        
        PID:940
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
        6⤵
        
        PID:2284
    - - C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
        5⤵
        
        PID:2028
      - C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
        6⤵
        
        PID:1344
    - - C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
        5⤵
        
        PID:2460
      - C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
        6⤵
        
        PID:2416
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
        6⤵
        
        PID:2348
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
        6⤵
        
        PID:1680
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
        6⤵
        
        PID:1300
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
        6⤵
        
        PID:1880
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
        6⤵
        
        PID:2984
    - - C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
        5⤵
        
        PID:2104
      - C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
        6⤵
        
        PID:1872
    - - C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
        5⤵
        
        PID:2008
    - - C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
        5⤵
        
        PID:1852
      - C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
        6⤵
        
        PID:1020
        
        C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
        7⤵
        
        PID:980
    - - C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
        5⤵
        
        PID:3056
      - C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
        6⤵
        
        PID:2016
    - - C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
        5⤵
        
        PID:600
      - C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
        6⤵
        
        PID:1464
        
        C:\Program Files\Common Files\System\msadc\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
        7⤵
        
        PID:3060
        
        C:\Program Files\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
        7⤵
        
        PID:2980
        
        C:\Program Files\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
        7⤵
        
        PID:1860
        
        C:\Program Files\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
        7⤵
        
        PID:1872
        
        C:\Program Files\Common Files\System\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
        7⤵
        
        PID:2268
        
        C:\Program Files\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
        7⤵
        
        PID:944
        
        C:\Program Files\Common Files\System\ado\backup.exe
        
        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
        7⤵
        
        PID:2444
    - - C:\Program Files\VideoLAN\VLC\locale\ne\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ne\update.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
        5⤵
        
        PID:2680
      - C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
        6⤵
        
        PID:3036
        
        C:\Program Files\Microsoft Games\Multiplayer\backup.exe
        
        "C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
        7⤵
        
        PID:3044
        
        C:\Program Files\Microsoft Games\More Games\data.exe
        
        "C:\Program Files\Microsoft Games\More Games\data.exe" C:\Program Files\Microsoft Games\More Games\
        7⤵
        
        PID:1160
        
        C:\Program Files\Microsoft Games\Minesweeper\update.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\update.exe" C:\Program Files\Microsoft Games\Minesweeper\
        7⤵
        
        PID:1632
        
        C:\Windows\addins\System Restore.exe
        
        "C:\Windows\addins\System Restore.exe" C:\Windows\addins\
        8⤵
        
        PID:1540
        
        C:\Windows\AppCompat\backup.exe
        
        C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
        8⤵
        
        PID:1460
        
        C:\Windows\AppPatch\backup.exe
        
        C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
        8⤵
        
        PID:2920
        
        C:\Windows\assembly\backup.exe
        
        C:\Windows\assembly\backup.exe C:\Windows\assembly\
        8⤵
        
        PID:1536
        
        C:\Program Files\Microsoft Games\Mahjong\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
        7⤵
        
        PID:2636
        
        C:\Program Files\Microsoft Games\Chess\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
        7⤵
        
        PID:1996
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
        8⤵
        
        PID:1968
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
        8⤵
        
        PID:1020
    - - C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\
        5⤵
        
        PID:3012
      - C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
        6⤵
        
        PID:1624
    - - C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
        5⤵
        
        PID:1772
    - - C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\
        5⤵
        
        PID:1644
    - - C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\
        5⤵
        
        PID:2804
    - - C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
        5⤵
        
        PID:1668
    - - C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
        5⤵
        
        PID:1596
      - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
        6⤵
        
        PID:2196
    - - C:\Program Files\VideoLAN\VLC\locale\it\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\
        5⤵
        
        PID:1020
      - C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
        6⤵
        
        PID:1568
    - - C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\
        5⤵
        
        PID:2796
    - - C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\
        5⤵
        
        PID:3036
    - - C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\
        5⤵
        
        PID:2532
    - - C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\
        5⤵
        
        PID:2548
    - - C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
        5⤵
        
        PID:1620
    - - C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\
        5⤵
        
        PID:1580
      - C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
        6⤵
        
        PID:900
    - - C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
        5⤵
        
        PID:1216
    - - C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
        5⤵
        
        PID:2976
      - C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
        6⤵
        
        PID:1984
        
        C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
        7⤵
        
        PID:2936
    - - C:\Program Files\VideoLAN\VLC\locale\es\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\
        5⤵
        
        PID:2256
    - - C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
        5⤵
        
        PID:2916
    - - C:\Program Files\VideoLAN\VLC\locale\el\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\
        5⤵
        
        PID:2408
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
        6⤵
        
        PID:948
    - - C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
        5⤵
        
        PID:2436
    - - C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
        5⤵
        
        PID:2572
    - - C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
        5⤵
        
        PID:1224
    - - C:\Program Files\VideoLAN\VLC\locale\co\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\co\update.exe" C:\Program Files\VideoLAN\VLC\locale\co\
        5⤵
        
        PID:2672
    - - C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\
        5⤵
        
        PID:2080
      - C:\Program Files\Java\jre7\backup.exe
        
        "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
        6⤵
        
        PID:2612
    - - C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
        5⤵
        
        PID:1868
    - - C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
        5⤵
        
        PID:2908
    - - C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
        5⤵
        
        PID:3012
    - - C:\Program Files\VideoLAN\VLC\locale\br\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\br\data.exe" C:\Program Files\VideoLAN\VLC\locale\br\
        5⤵
        
        PID:1772
    - - C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
        5⤵
        
        PID:1880
    - - C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
        5⤵
        
        PID:1076
    - - C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
        5⤵
        
        PID:1984
    - - C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
        5⤵
        
        PID:1348
    - - C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
        5⤵
        
        PID:2976
    - - C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
        5⤵
        
        PID:1848
    - - C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
        5⤵
        
        PID:1364
      - C:\Program Files\Java\jre7\lib\images\cursors\backup.exe
        
        "C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\
        6⤵
        
        PID:2692
    - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
        5⤵
        
        PID:2840
    - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
        5⤵
        
        PID:2988
    - - C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
        5⤵
        
        PID:2036
    - - C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
        5⤵
        
        PID:2576
    - - C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
        5⤵
        
        PID:2732
  - - C:\Program Files\VideoLAN\VLC\lua\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
      4⤵
      PID:3060
    - - C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
        5⤵
        
        PID:2648
    - - C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
        5⤵
        
        PID:1492
  - - C:\Program Files\VideoLAN\VLC\plugins\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\
      4⤵
      PID:2700
  - - C:\Program Files\VideoLAN\VLC\skins\backup.exe
      "C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
      4⤵
      PID:1292
    - - C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
        5⤵
        
        PID:2488
  - - C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
      "C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
      4⤵
      PID:2580
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
  2⤵
  PID:1716

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:1628

C:\Program Files\Internet Explorer\ja-JP\backup.exe
"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
1⤵
PID:1988

C:\Program Files\Java\System Restore.exe
"C:\Program Files\Java\System Restore.exe" C:\Program Files\Java\
1⤵
PID:2080
- C:\Program Files\Java\jdk1.7.0_80\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\data.exe" C:\Program Files\Java\jdk1.7.0_80\
  2⤵
  PID:1780
- - C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
    3⤵
    PID:3004
- - C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
    3⤵
    PID:1836
  - - C:\Program Files\Internet Explorer\SIGNUP\backup.exe
      "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
      4⤵
      PID:2064
  - - C:\Program Files\Internet Explorer\it-IT\backup.exe
      "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
      4⤵
      PID:1532
  - - C:\Program Files\Internet Explorer\images\backup.exe
      "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
      4⤵
      PID:2788
  - - C:\Program Files\Internet Explorer\fr-FR\backup.exe
      "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
      4⤵
      PID:932
  - - C:\Program Files\Internet Explorer\es-ES\backup.exe
      "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
      4⤵
      PID:1344
  - - C:\Program Files\Internet Explorer\en-US\backup.exe
      "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
      4⤵
      PID:2448
  - - C:\Program Files\Internet Explorer\de-DE\backup.exe
      "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
      4⤵
      PID:1904
    - - C:\Program Files\Windows Journal\Templates\backup.exe
        
        "C:\Program Files\Windows Journal\Templates\backup.exe" C:\Program Files\Windows Journal\Templates\
        5⤵
        
        PID:804
- - C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
    3⤵
    PID:1560
- - C:\Program Files\Java\jdk1.7.0_80\db\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\
    3⤵
    PID:2100
- - C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
    3⤵
    PID:2712
  - - C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
      "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
      4⤵
      PID:1064
- C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
  2⤵
  PID:656

C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
1⤵
PID:2992
- C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\
  2⤵
  PID:2876

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
1⤵
PID:1752

C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
1⤵
PID:1420

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
1⤵
PID:1360
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
  2⤵
  PID:2660

C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
1⤵
PID:3060
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\System Restore.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\System Restore.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\
  2⤵
  PID:1076
- - C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
    3⤵
    PID:2940
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\
  2⤵
  PID:2592

C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
1⤵
PID:2624
- C:\Program Files (x86)\Google\Update\1.3.36.151\System Restore.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.151\System Restore.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
  2⤵
  PID:1836

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
1⤵
PID:2284

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
1⤵
PID:2724

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
1⤵
PID:1792

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
1⤵
PID:2796

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
1⤵
PID:804

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
1⤵
PID:2020
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
  2⤵
  PID:2348

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
1⤵
PID:976
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
  2⤵
  PID:2120
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
    3⤵
    PID:2856
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
    3⤵
    PID:1924
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
    3⤵
    PID:1596
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
    3⤵
    PID:2364
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:2596
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:1584
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
      4⤵
      PID:2688
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
  2⤵
  PID:1124
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
    3⤵
    PID:1432
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
      4⤵
      PID:1752
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
    3⤵
    PID:892
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
      4⤵
      PID:1420
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
      4⤵
      PID:852
    - - C:\Program Files\MSBuild\Microsoft\System Restore.exe
        
        "C:\Program Files\MSBuild\Microsoft\System Restore.exe" C:\Program Files\MSBuild\Microsoft\
        5⤵
        
        PID:2652
      - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
        6⤵
        
        PID:2604
- C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
  2⤵
  PID:1584
- C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
  2⤵
  PID:2088
- C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
  2⤵
  PID:1716
- C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
  2⤵
  PID:2384
- C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\
  2⤵
  PID:2756
- C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
  2⤵
  PID:2572

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
1⤵
PID:2296

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2552

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
1⤵
PID:2708

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
1⤵
PID:1216
- C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
  2⤵
  PID:2760

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
1⤵
PID:800

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
1⤵
PID:2796
- C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\
  2⤵
  PID:2180
- - C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
    3⤵
    PID:2120
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
      4⤵
      PID:2020
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
      4⤵
      PID:948
    - - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        5⤵
        
        PID:2636
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
      4⤵
      PID:1300
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
      4⤵
      PID:1364
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
      4⤵
      PID:2436
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
      4⤵
      PID:2968
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
        5⤵
        
        PID:632
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
        5⤵
        
        PID:2480
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
        5⤵
        
        PID:1208
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
        5⤵
        
        PID:2592
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
        5⤵
        
        PID:2564
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
      4⤵
      PID:2560
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
      4⤵
      PID:856
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\
      4⤵
      PID:1312
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
      4⤵
      PID:2928
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
      4⤵
      PID:1452
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
      4⤵
      PID:2424
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
      4⤵
      PID:2444
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
      4⤵
      PID:1816
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
      4⤵
      PID:2300
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
      4⤵
      PID:2644

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:804

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\
1⤵
PID:2176

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
1⤵
PID:2296

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
1⤵
PID:408
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
  2⤵
  PID:2428

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
1⤵
PID:612
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
  2⤵
  PID:2948
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
  2⤵
  PID:2992
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
    3⤵
    PID:980
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
    3⤵
    PID:2016
  - - C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe
      "C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\
      4⤵
      PID:2720
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
  2⤵
  PID:2016

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
1⤵
PID:2468

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
1⤵
PID:2912
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
  2⤵
  PID:2732

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
1⤵
PID:2596

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
1⤵
PID:2460

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
1⤵
PID:2180

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
1⤵
PID:2176

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
1⤵
PID:1676
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
  2⤵
  PID:2068
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
    3⤵
    PID:1284
  - - C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
      4⤵
      PID:1432
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
    3⤵
    PID:448
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
  2⤵
  PID:2260

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:1096

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
1⤵
PID:1728

C:\Program Files\Java\jre7\bin\backup.exe
"C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
1⤵
PID:2628
- C:\Program Files\Java\jre7\bin\server\backup.exe
  "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
  2⤵
  PID:1976
- C:\Program Files\Java\jre7\bin\plugin2\backup.exe
  "C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
  2⤵
  PID:1708
- C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
  2⤵
  PID:3008

C:\Program Files\Java\jre7\lib\applet\backup.exe
"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
1⤵
PID:2572

C:\Program Files\Java\jre7\lib\deploy\System Restore.exe
"C:\Program Files\Java\jre7\lib\deploy\System Restore.exe" C:\Program Files\Java\jre7\lib\deploy\
1⤵
PID:2756

C:\Program Files\Java\jre7\lib\security\update.exe
"C:\Program Files\Java\jre7\lib\security\update.exe" C:\Program Files\Java\jre7\lib\security\
1⤵
PID:804

C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
1⤵
PID:1080

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
1⤵
PID:1592

C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
1⤵
PID:2296

C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
1⤵
PID:836

C:\Program Files\Java\jre7\lib\zi\Europe\update.exe
"C:\Program Files\Java\jre7\lib\zi\Europe\update.exe" C:\Program Files\Java\jre7\lib\zi\Europe\
1⤵
PID:2260

C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
1⤵
PID:980

C:\Program Files\Microsoft Games\FreeCell\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
1⤵
PID:2616
- C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
  2⤵
  PID:2516
- C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
  2⤵
  PID:2532
- C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
  2⤵
  PID:2772
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\
    3⤵
    PID:1776
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
      4⤵
      PID:2796
- - C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\
    3⤵
    PID:2296
  - - C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\
      4⤵
      PID:2024
- - C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\
    3⤵
    PID:956
- C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
  2⤵
  PID:2792
- C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
  2⤵
  PID:1112
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
    3⤵
    PID:2612
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
    3⤵
    PID:856
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
    3⤵
    PID:1360
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
    3⤵
    PID:900
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
    3⤵
    PID:1636
- C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
  2⤵
  PID:1132
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
    3⤵
    PID:2308

C:\Program Files\Microsoft Games\Hearts\backup.exe
"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
1⤵
PID:1124
- C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
  2⤵
  PID:2936
- C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
  2⤵
  PID:1344
- C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
  2⤵
  PID:400
- C:\Program Files\Microsoft Games\Hearts\fr-FR\update.exe
  "C:\Program Files\Microsoft Games\Hearts\fr-FR\update.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
  2⤵
  PID:1880
- C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
  2⤵
  PID:2136
- C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
  2⤵
  PID:2940
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
  2⤵
  PID:2848
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
  2⤵
  PID:2604
- - C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
    3⤵
    PID:1872
- - C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
    3⤵
    PID:1592
- - C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\
    3⤵
    PID:2676
- - C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
    3⤵
    PID:568

C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
1⤵
PID:956

C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
1⤵
PID:2712
- C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
  2⤵
  PID:2548
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
    3⤵
    PID:2056
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
    3⤵
    PID:2900
- C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
  2⤵
  PID:3028
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
  2⤵
  PID:1220
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
  2⤵
  PID:2036
- - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
    3⤵
    PID:1528
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
  2⤵
  PID:2480
- - C:\Program Files\Java\jre7\lib\zi\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
    3⤵
    PID:2064
- - C:\Program Files\Java\jre7\lib\management\backup.exe
    "C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
    3⤵
    PID:2796
- - C:\Program Files\Java\jre7\lib\jfr\backup.exe
    "C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
    3⤵
    PID:1300
- - C:\Program Files\Java\jre7\lib\images\backup.exe
    "C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
    3⤵
    PID:1364
- - C:\Program Files\Java\jre7\lib\fonts\backup.exe
    "C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\
    3⤵
    PID:1716
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
      4⤵
      PID:2380
    - - C:\Program Files\Google\Chrome\Application\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
        5⤵
        
        PID:1716
  - - C:\Program Files\Google\Chrome\Application\SetupMetrics\System Restore.exe
      "C:\Program Files\Google\Chrome\Application\SetupMetrics\System Restore.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
      4⤵
      PID:2508
- - C:\Program Files\Java\jre7\lib\ext\backup.exe
    "C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
    3⤵
    PID:2380
- - C:\Program Files\Java\jre7\lib\cmm\backup.exe
    "C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
    3⤵
    PID:2508
- - C:\Program Files\Java\jre7\lib\amd64\data.exe
    "C:\Program Files\Java\jre7\lib\amd64\data.exe" C:\Program Files\Java\jre7\lib\amd64\
    3⤵
    PID:1628
  - - C:\Program Files\Common Files\System\backup.exe
      "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
      4⤵
      PID:1464
  - - C:\Program Files\Common Files\SpeechEngines\backup.exe
      "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
      4⤵
      PID:2712
    - - C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\art\
        5⤵
        
        PID:1892
  - - C:\Program Files\Common Files\Services\backup.exe
      "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
      4⤵
      PID:2080
  - - C:\Program Files\Common Files\Microsoft Shared\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
      4⤵
      PID:1564
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
  2⤵
  PID:3056
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
  2⤵
  PID:1968
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\
    3⤵
    PID:108
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
  2⤵
  PID:800
- - C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\
    3⤵
    PID:2288
- - C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
    3⤵
    PID:1064
- - C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\
    3⤵
    PID:2752
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
  2⤵
  PID:2432
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\
  2⤵
  PID:712
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\
  2⤵
  PID:2296

C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
1⤵
PID:2976
- C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\
  2⤵
  PID:2424

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
1⤵
PID:784
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\
  2⤵
  PID:2608
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
  2⤵
  PID:2972
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\
  2⤵
  PID:2740
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\
  2⤵
  PID:2108
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\
  2⤵
  PID:1468
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
  2⤵
  PID:2204
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
    3⤵
    PID:1468
- - C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
    3⤵
    PID:568
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
    3⤵
    PID:2364
- - C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
    3⤵
    PID:2036
- - C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
    3⤵
    PID:2444
  - - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
      4⤵
      PID:1560
  - - C:\Program Files\Common Files\System\ado\it-IT\backup.exe
      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
      4⤵
      PID:2856
  - - C:\Program Files\Common Files\System\ado\es-ES\System Restore.exe
      "C:\Program Files\Common Files\System\ado\es-ES\System Restore.exe" C:\Program Files\Common Files\System\ado\es-ES\
      4⤵
      PID:2256
  - - C:\Program Files\Common Files\System\ado\en-US\update.exe
      "C:\Program Files\Common Files\System\ado\en-US\update.exe" C:\Program Files\Common Files\System\ado\en-US\
      4⤵
      PID:2056
  - - C:\Program Files\Common Files\System\ado\de-DE\backup.exe
      "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
      4⤵
      PID:2344
- - C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
    3⤵
    PID:1492
- - C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
    3⤵
    PID:1568
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
    3⤵
    PID:2272
- - C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
    3⤵
    PID:2180
- - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
    3⤵
    PID:2824

C:\Program Files\Microsoft Games\Purble Place\update.exe
"C:\Program Files\Microsoft Games\Purble Place\update.exe" C:\Program Files\Microsoft Games\Purble Place\
1⤵
PID:800
- C:\Program Files\Microsoft Games\Purble Place\de-DE\data.exe
  "C:\Program Files\Microsoft Games\Purble Place\de-DE\data.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
  2⤵
  PID:1688
- C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
  2⤵
  PID:1620
- - C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
    3⤵
    PID:1080
- C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
  2⤵
  PID:3004

C:\Program Files (x86)\Adobe\data.exe
"C:\Program Files (x86)\Adobe\data.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:1892
- C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
  2⤵
  PID:2348
- - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\data.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
    3⤵
    PID:956
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\System Restore.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
      4⤵
      PID:2296

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
1⤵
PID:448

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
1⤵
PID:1876

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
1⤵
PID:1096
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
  2⤵
  PID:2244

C:\Program Files\Microsoft Games\Solitaire\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
1⤵
PID:2268
- C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
  2⤵
  PID:1528
- - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
    3⤵
    PID:1596
  - - C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
      4⤵
      PID:640
- C:\Program Files\Microsoft Games\Solitaire\en-US\System Restore.exe
  "C:\Program Files\Microsoft Games\Solitaire\en-US\System Restore.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
  2⤵
  PID:2520
- C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
  2⤵
  PID:1668
- - C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
    3⤵
    PID:2284

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
1⤵
PID:2596

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
1⤵
PID:1432
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
  2⤵
  PID:1608
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\
    3⤵
    PID:2204
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
      4⤵
      PID:2456
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\
    3⤵
    PID:1896
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\System Restore.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
    3⤵
    PID:1344
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
    3⤵
    PID:2500
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\update.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\
    3⤵
    PID:2416

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
1⤵
PID:1600

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
1⤵
PID:1132
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
  2⤵
  PID:3032

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
1⤵
PID:1336
- C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\
  2⤵
  PID:1184

C:\Program Files\Microsoft Office\backup.exe
"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
1⤵
PID:1536

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\update.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
1⤵
PID:1652

C:\Program Files\Mozilla Firefox\browser\backup.exe
"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
1⤵
PID:1568
- C:\Program Files\Mozilla Firefox\browser\features\update.exe
  "C:\Program Files\Mozilla Firefox\browser\features\update.exe" C:\Program Files\Mozilla Firefox\browser\features\
  2⤵
  PID:2224
- C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
  2⤵
  PID:1544

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
1⤵
PID:2784

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:2636
- C:\Program Files\Mozilla Firefox\defaults\backup.exe
  "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
  2⤵
  PID:3004
- - C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
    "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
    3⤵
    PID:1968
- C:\Program Files\Mozilla Firefox\fonts\backup.exe
  "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
  2⤵
  PID:2244
- C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
  2⤵
  PID:2596
- - C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
    "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
    3⤵
    PID:1636

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
1⤵
PID:2252
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
  2⤵
  PID:2980
- C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
  2⤵
  PID:2992
- C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
  2⤵
  PID:2428
- C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
  2⤵
  PID:2224
- C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
  2⤵
  PID:1492
- C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
  2⤵
  PID:2752
- C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
  2⤵
  PID:2216
- C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
  2⤵
  PID:1092
- C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
  2⤵
  PID:2820
- C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
  2⤵
  PID:1776
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\
    3⤵
    PID:2328
- C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
  2⤵
  PID:2640
- C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
  2⤵
  PID:2088
- C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
  2⤵
  PID:2536
- C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
  2⤵
  PID:2532
- C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
  2⤵
  PID:2792
- C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
  2⤵
  PID:2836
- C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
  2⤵
  PID:2332
- C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
  2⤵
  PID:1868
- C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
  2⤵
  PID:2976
- C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
  2⤵
  PID:1036
- C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
  2⤵
  PID:2340
- C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
  2⤵
  PID:2444

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
1⤵
PID:2204
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
  2⤵
  PID:1724
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
    3⤵
    PID:2112

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
1⤵
PID:2512

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
1⤵
PID:2776

C:\Program Files\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
1⤵
PID:2004

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
1⤵
PID:2592

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
1⤵
PID:3044
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
  2⤵
  PID:1204
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
  2⤵
  PID:1092
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
  2⤵
  PID:1300
- C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
  2⤵
  PID:976
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
    3⤵
    PID:2068
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
    3⤵
    PID:1968
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
    3⤵
    PID:1028
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\data.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\data.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\
  2⤵
  PID:3060
- - C:\Program Files\VideoLAN\VLC\lua\modules\data.exe
    "C:\Program Files\VideoLAN\VLC\lua\modules\data.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
    3⤵
    PID:1896
- - C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
    3⤵
    PID:2784
- - C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
    3⤵
    PID:1852
- - C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
    3⤵
    PID:2568
- - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
    3⤵
    PID:1760

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:948

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
1⤵
PID:112

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
1⤵
PID:1632
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
  2⤵
  PID:640

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System Restore.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
1⤵
PID:2992

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
1⤵
PID:2300

C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
1⤵
PID:3000
- C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
  2⤵
  PID:2564
- - C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
    3⤵
    PID:2516
- C:\Program Files\DVD Maker\it-IT\backup.exe
  "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
  2⤵
  PID:2700
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
    3⤵
    PID:1344
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
    3⤵
    PID:400
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
    3⤵
    PID:2760
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
    3⤵
    PID:2632
- C:\Program Files\DVD Maker\en-US\backup.exe
  "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
  2⤵
  PID:1904

C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
1⤵
PID:2028

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
1⤵
PID:2772
- C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
  2⤵
  PID:1204
- C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\
  2⤵
  PID:1028
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
  2⤵
  PID:2464
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\
    3⤵
    PID:2940
- C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\
  2⤵
  PID:2564
- - C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
    3⤵
    PID:2688
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
  2⤵
  PID:2160
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
    3⤵
    PID:1792
  - - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
      4⤵
      PID:2072
- C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
  2⤵
  PID:2776
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
  2⤵
  PID:1652
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
    3⤵
    PID:1972
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\
    3⤵
    PID:1872
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\
    3⤵
    PID:2244
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
  2⤵
  PID:2472
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
    3⤵
    PID:2004
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\update.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
      4⤵
      PID:2548
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
    3⤵
    PID:892
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\
    3⤵
    PID:2656
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
    3⤵
    PID:2088
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\
    3⤵
    PID:1336
  - - C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
      4⤵
      PID:2436
  - - C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
      4⤵
      PID:1880
  - - C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
      4⤵
      PID:1628
  - - C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
      "C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
      4⤵
      PID:2532
  - - C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
      4⤵
      PID:776
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\data.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
    3⤵
    PID:2340
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
    3⤵
    PID:1916
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\data.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
    3⤵
    PID:1488
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
    3⤵
    PID:2440
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\
    3⤵
    PID:1456
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
    3⤵
    PID:2364
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
    3⤵
    PID:2412
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
    3⤵
    PID:2928
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
    3⤵
    PID:1884
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
    3⤵
    PID:2724
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\
    3⤵
    PID:1284
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
      4⤵
      PID:1512
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\
    3⤵
    PID:1544
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\System Restore.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\
    3⤵
    PID:1568
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\data.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\
    3⤵
    PID:2496
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\
    3⤵
    PID:856
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\
    3⤵
    PID:892
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
      4⤵
      PID:836
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
      4⤵
      PID:980
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
      4⤵
      PID:832
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\update.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\
      4⤵
      PID:2072
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\update.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\
    3⤵
    PID:2984
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
      4⤵
      PID:1896
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
      4⤵
      PID:2096
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
      4⤵
      PID:2476
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\
    3⤵
    PID:2972
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
    3⤵
    PID:1076
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\
    3⤵
    PID:2824
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\
    3⤵
    PID:1512
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\
    3⤵
    PID:2872
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\
    3⤵
    PID:1900
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\
    3⤵
    PID:2572
  - - C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\
      4⤵
      PID:2592
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
        5⤵
        
        PID:2632
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\
    3⤵
    PID:1484
  - - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\data.exe
      "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\data.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
      4⤵
      PID:1892
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
    3⤵
    PID:2500
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\
    3⤵
    PID:2708
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
    3⤵
    PID:2404
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\
    3⤵
    PID:2516
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
    3⤵
    PID:2660
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
    3⤵
    PID:2052
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
    3⤵
    PID:2948
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\System Restore.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
    3⤵
    PID:1568
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
    3⤵
    PID:2348
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
      4⤵
      PID:2060
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
    3⤵
    PID:1140
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\
    3⤵
    PID:2336
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\
    3⤵
    PID:2848
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
      4⤵
      PID:2404
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\
    3⤵
    PID:2688
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
    3⤵
    PID:1836
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
      4⤵
      PID:2488
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
    3⤵
    PID:2600
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\
  2⤵
  PID:804
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
    3⤵
    PID:2348
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\
    3⤵
    PID:1900
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\
    3⤵
    PID:2256
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\data.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\
    3⤵
    PID:2896
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\data.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\
    3⤵
    PID:2424
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\
    3⤵
    PID:1604
- C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
  2⤵
  PID:2464
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
    3⤵
    PID:892
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
    3⤵
    PID:3060
  - - C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
      4⤵
      PID:2244
    - - C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\modules\
        5⤵
        
        PID:2828
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
        6⤵
        
        PID:776
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
        6⤵
        
        PID:2284
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
        6⤵
        
        PID:2620
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
        6⤵
        
        PID:2592
  - - C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
      4⤵
      PID:2712
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
      4⤵
      PID:2284
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\
      4⤵
      PID:2580
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\
      4⤵
      PID:2684
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
      4⤵
      PID:856
- C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
  2⤵
  PID:2160
- C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\
  2⤵
  PID:948
- C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\
  2⤵
  PID:3016
- C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
  2⤵
  PID:2928
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
    3⤵
    PID:2356
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
  2⤵
  PID:1632
- - C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
    3⤵
    PID:2056
- - C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
    3⤵
    PID:2020
- - C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
    3⤵
    PID:1828
- - C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
    3⤵
    PID:2344
- C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
  2⤵
  PID:1020
- C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
  2⤵
  PID:1608
- C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\
  2⤵
  PID:1848
- C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
  2⤵
  PID:2712
- C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\
  2⤵
  PID:1652
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
    3⤵
    PID:2460
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\
    3⤵
    PID:2668
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
    3⤵
    PID:1600
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
    3⤵
    PID:640
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
      4⤵
      PID:3044
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
      4⤵
      PID:2364
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
      4⤵
      PID:1292
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\System Restore.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
      4⤵
      PID:1348
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
    3⤵
    PID:2052
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
    3⤵
    PID:1728
- C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
  2⤵
  PID:1620
- C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
  2⤵
  PID:840
- C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
  2⤵
  PID:2536
- C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
  2⤵
  PID:2936
- C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
  2⤵
  PID:1220
- C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\
  2⤵
  PID:1628

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
1⤵
PID:1456

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
1⤵
PID:2012

C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
1⤵
PID:2944

C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\
1⤵
PID:1984

C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
1⤵
PID:2168

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:1076

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
1⤵
PID:2700

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
1⤵
PID:1068

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
1⤵
PID:1664

C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
1⤵
PID:2296

C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
1⤵
PID:1664

C:\Users\Admin\backup.exe
C:\Users\Admin\backup.exe C:\Users\Admin\
1⤵
PID:1916
- C:\Users\Admin\Contacts\backup.exe
  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
  2⤵
  PID:3004
- - C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
    3⤵
    PID:1284
- C:\Users\Admin\Downloads\backup.exe
  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
  2⤵
  PID:2540
- C:\Users\Admin\Links\backup.exe
  C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
  2⤵
  PID:2660
- C:\Users\Admin\Favorites\backup.exe
  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
  2⤵
  PID:2568
- C:\Users\Admin\Music\data.exe
  C:\Users\Admin\Music\data.exe C:\Users\Admin\Music\
  2⤵
  PID:2276
- C:\Users\Admin\Pictures\backup.exe
  C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
  2⤵
  PID:1196
- C:\Users\Admin\Documents\backup.exe
  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
  2⤵
  PID:2168
- C:\Users\Admin\Saved Games\backup.exe
  "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
  2⤵
  PID:400
- C:\Users\Admin\Searches\backup.exe
  C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
  2⤵
  PID:1532
- C:\Users\Admin\Videos\backup.exe
  C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
  2⤵
  PID:1560
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
    3⤵
    PID:1652
- C:\Users\Admin\Desktop\backup.exe
  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
  2⤵
  PID:2440

C:\Users\Public\backup.exe
C:\Users\Public\backup.exe C:\Users\Public\
1⤵
PID:1704

C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
1⤵
PID:2944
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
  2⤵
  PID:1532
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\update.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
  2⤵
  PID:2380
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
  2⤵
  PID:2664

C:\Program Files (x86)\Google\backup.exe
"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
1⤵
PID:3012
- C:\Program Files (x86)\Google\CrashReports\backup.exe
  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
  2⤵
  PID:1652
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
    3⤵
    PID:1868
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\
    3⤵
    PID:2300
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
    3⤵
    PID:2644
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
    3⤵
    PID:712
- C:\Program Files (x86)\Google\Temp\backup.exe
  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
  2⤵
  PID:2484
- C:\Program Files (x86)\Google\Update\backup.exe
  "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
  2⤵
  PID:2624
- - C:\Program Files (x86)\Google\Update\Download\backup.exe
    "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
    3⤵
    PID:2924
  - - C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
      "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
      4⤵
      PID:1564
    - - C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
        5⤵
        
        PID:932
    - - C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
        5⤵
        
        PID:1588
    - - C:\Program Files\Common Files\Microsoft Shared\VC\data.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VC\data.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
        5⤵
        
        PID:1488
    - - C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
        5⤵
        
        PID:2700
    - - C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
        5⤵
        
        PID:2828
    - - C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
        5⤵
        
        PID:2276
    - - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
        5⤵
        
        PID:2384
    - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
        5⤵
        
        PID:640
    - - C:\Program Files\Common Files\Microsoft Shared\ink\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
        5⤵
        
        PID:2252
    - - C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
        5⤵
        
        PID:2092
  - - C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
      4⤵
      PID:2476
- - C:\Program Files (x86)\Google\Update\Install\backup.exe
    "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
    3⤵
    PID:484
  - - C:\Program Files (x86)\Google\Update\Install\{1187FFC4-7B4C-4060-83CA-88C53EC9AD16}\backup.exe
      "C:\Program Files (x86)\Google\Update\Install\{1187FFC4-7B4C-4060-83CA-88C53EC9AD16}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{1187FFC4-7B4C-4060-83CA-88C53EC9AD16}\
      4⤵
      PID:1296
- - C:\Program Files (x86)\Google\Update\Offline\backup.exe
    "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
    3⤵
    PID:2908

C:\Program Files (x86)\Common Files\Services\backup.exe
"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
1⤵
PID:2940

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2268
- C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\
  2⤵
  PID:2356
- C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\
  2⤵
  PID:1220
- C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
  2⤵
  PID:2196

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:1888

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
1⤵
PID:804

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:1632
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
  2⤵
  PID:1432
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\
    3⤵
    PID:784
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
    3⤵
    PID:2196
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
  2⤵
  PID:2568
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
  2⤵
  PID:1420
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
  2⤵
  PID:1456
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
  2⤵
  PID:2948

C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\
1⤵
PID:2492

C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
1⤵
PID:1584

C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
1⤵
PID:2380

C:\Program Files (x86)\Internet Explorer\backup.exe
"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
1⤵
PID:2804
- C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
  "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
  2⤵
  PID:1608
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
    3⤵
    PID:2272
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\
    3⤵
    PID:1364
  - - C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
      4⤵
      PID:1988
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
    3⤵
    PID:2824
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
    3⤵
    PID:2580
- C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
  "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
  2⤵
  PID:568
- C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
  "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
  2⤵
  PID:1164
- C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
  "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
  2⤵
  PID:2972
- C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
  "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
  2⤵
  PID:2752
- C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
  "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
  2⤵
  PID:1512
- C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
  "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
  2⤵
  PID:1132

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:1904
- C:\Program Files\Windows Journal\de-DE\backup.exe
  "C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\
  2⤵
  PID:2060

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
1⤵
PID:2248

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\
1⤵
PID:1652

C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
1⤵
PID:1148

C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
1⤵
PID:1624

C:\Program Files (x86)\Common Files\System\backup.exe
"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
1⤵
PID:1100

C:\Program Files\Windows Mail\System Restore.exe
"C:\Program Files\Windows Mail\System Restore.exe" C:\Program Files\Windows Mail\
1⤵
PID:1772

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\update.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
1⤵
PID:2436

C:\Program Files\VideoLAN\update.exe
"C:\Program Files\VideoLAN\update.exe" C:\Program Files\VideoLAN\
1⤵
PID:2764

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
1⤵
PID:2736

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
1⤵
PID:2672

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
1⤵
PID:1728

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
1⤵
PID:2852

C:\Program Files (x86)\Common Files\Adobe\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
1⤵
PID:2288

C:\Program Files (x86)\Common Files\backup.exe
"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
1⤵
PID:1228

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:1028
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
  2⤵
  PID:448

C:\Program Files (x86)\Microsoft Office\backup.exe
"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
1⤵
PID:2016

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
1⤵
PID:1536
- C:\Program Files\Microsoft Office\Office14\backup.exe
  "C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
  2⤵
  PID:1776

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:2380
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
  2⤵
  PID:2648

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:2940

C:\Program Files\MSBuild\update.exe
"C:\Program Files\MSBuild\update.exe" C:\Program Files\MSBuild\
1⤵
PID:852

C:\Program Files\Windows Media Player\backup.exe
"C:\Program Files\Windows Media Player\backup.exe" C:\Program Files\Windows Media Player\
1⤵
PID:640

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
1⤵
PID:2644

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
1⤵
PID:1128

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
1⤵
PID:1700

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
1⤵
PID:2592

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
1⤵
PID:2944

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
1⤵
PID:2224

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:1088
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft Synchronization Services\System Restore.exe
  "C:\Program Files (x86)\Microsoft Synchronization Services\System Restore.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft.NET\backup.exe
  "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
  2⤵
  PID:2652
- C:\Program Files (x86)\Mozilla Maintenance Service\System Restore.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\System Restore.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
  2⤵
  PID:2508

C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
1⤵
PID:1444
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
  2⤵
  PID:2896

C:\Program Files\Microsoft Games\More Games\it-IT\update.exe
"C:\Program Files\Microsoft Games\More Games\it-IT\update.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
1⤵
PID:2948

C:\Program Files\Windows NT\backup.exe
"C:\Program Files\Windows NT\backup.exe" C:\Program Files\Windows NT\
1⤵
PID:2840

C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
1⤵
PID:1852

C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe
"C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
1⤵
PID:2016

C:\Program Files\Microsoft Games\More Games\en-US\data.exe
"C:\Program Files\Microsoft Games\More Games\en-US\data.exe" C:\Program Files\Microsoft Games\More Games\en-US\
1⤵
PID:1100
- C:\Program Files (x86)\Common Files\System\ado\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
  2⤵
  PID:1688

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
1⤵
PID:3028

C:\Program Files\Microsoft Games\backup.exe
"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
1⤵
PID:3036

C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
"C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
1⤵
PID:1816

C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
1⤵
PID:1924

C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
1⤵
PID:584

C:\Program Files\Java\jre7\lib\zi\Atlantic\System Restore.exe
"C:\Program Files\Java\jre7\lib\zi\Atlantic\System Restore.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
1⤵
PID:1876

C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
1⤵
PID:408

C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
1⤵
PID:2256

C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
1⤵
PID:2100
- C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
  2⤵
  PID:832
- C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
  2⤵
  PID:1020

C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
1⤵
PID:2884

C:\Program Files\Java\jre7\lib\zi\America\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
1⤵
PID:1812

C:\Program Files\Java\jre7\lib\backup.exe
"C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
1⤵
PID:2480

C:\Program Files\Windows Photo Viewer\backup.exe
"C:\Program Files\Windows Photo Viewer\backup.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:2436

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\
1⤵
PID:1708

C:\Program Files\Windows Portable Devices\backup.exe
"C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
1⤵
PID:2216

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:1836

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
1⤵
PID:2696

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:1700

C:\Program Files\Windows Sidebar\backup.exe
"C:\Program Files\Windows Sidebar\backup.exe" C:\Program Files\Windows Sidebar\
1⤵
PID:1208

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:3000

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:1628

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
PID:948

C:\Program Files\backup.exe
"C:\Program Files\backup.exe" C:\Program Files\
1⤵
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
36KB

MD5
7e319d410a80cbc5a9f9951d0d516a35

SHA1
75bfa1ba1d6d9fe32bb060e62e5ef8da2e29a54e

SHA256
b54c9e608a4df046a554bf26e0b7461615b966fefeb6b98864a300979d552d7c

SHA512
1b1f82325f3fe52db44107c8abf69a9400c3ada19c0e6692aec04a96dc3ac5f4bdd9ab230f433f36f141460f0f9250ec30c7f4cc85d4f4ef792cd6e2b9a9cc11

Download Submit
C:\PerfLogs\backup.exe

Filesize
6KB

MD5
b07ce1f09a3f46d4f67a02ce13612a09

SHA1
9d7f408d4a2126507bb785cfbdc13a77a7ee0718

SHA256
deae0ee4e65bea70bcc3ea472d2f7841ca384dc597c6bebf9dfafb8cc714a4b8

SHA512
8ec781611e0b4f36714d8997e3d5f54d5dc1d244b322c578d96e8c7b54ec7eab425fd51bfa98f4b6e9dd63ad37082649952eb67feba6a88c4472cc8b6e1131de

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
25KB

MD5
4a82a29a7c0dd8f1ff55a6c4e58db4cc

SHA1
57171d260746b8fe96771edb9b8cfb86c9015827

SHA256
0737c368a9ac3d8276b26cce03dae6597ab6fe1a6f7e2c2a689028bb3ab7c67d

SHA512
8530257709f81529042f1b95b34ff2747b8fcc67c2cc37e770110fb924580320a15c786fd167712dd04a25575f0bc0be7b06ec829903cd56a49878b2d900e91d

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
17KB

MD5
a3d575301d0bb5ce1fe2e2fe92f1e6fa

SHA1
c3e25a99446d6484ce8aa3b48215643479ca18f9

SHA256
88c462097c58b7c1c40585623f956dfbc4c9fca2faa04a125e34ca5b6b746f78

SHA512
ce568116fdba9a77e475cdf4489a1a9dcede1f5abae4fa0ccc737d9f6f5b4b2e5ffcf5e59658991e6a4936aea74372a5e138c148269873a133fa5fec850640c9

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
72KB

MD5
56600990d8ec85eb7851a3999acf135f

SHA1
fbbce41b80b582be6b03e785c48c7a728b12b018

SHA256
6084dcd2b19db81c4eaf879ddf9a8f0e8523c80b3f65df218b493dcf211e5115

SHA512
d986f9710a11f1160a2827998d0ae10525075b4bb01c3641bd643010cd05de5c7451c71e0fd06fa9da029fedc9f7ed5e4ea79ea8082764e9df5ee32e4e58d1f3

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\update.exe

Filesize
13KB

MD5
278019fda539b6a432c9c53292a3f035

SHA1
43d357d5af410ad0901f28695166d0e2106a22d0

SHA256
d0d603a450907cc1b64dc2206567069f892ae437c96960ac0a1d61497b4757eb

SHA512
a48a7a1be9c79b0ad9bc38c606f7f48db6b6c3b12ad9446b499b5e703b31d1686317e18c55a519e6231044c8070b251354a275c567172f3c16d30bd1d00612e9

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
ae26b701c9f5cc91165ef457b12cbe6b

SHA1
02099374e2fd93546e440f3435e7228bc6b14650

SHA256
3b9527ac9e27aa783f0a8101367e4a60de91d899eb13a2974abecfd7ef2b7647

SHA512
5c24570451424c5fe922a9d25fb2c5b952babc446896bd60210df38910e2ce08b8db3b075840067c171dad013a3ae907c22bb3f392a62d966cc81af015a1dd98

Download Submit
C:\Program Files\backup.exe

Filesize
12KB

MD5
bf171b37c6d1ab91ef6928d30fed7339

SHA1
fc7229296fc318e11d4c1842828f74ef9dffbc7d

SHA256
5c3b009046fbebf3e74c57605958711659d3c9c463f1083387aed206f8c332de

SHA512
b680b61e8d1afdd7427f3df376cd02350830c9c9c2b735767d8e2671c2f2bca6ce83378f49579b792fe7c1ef8fb89766d2638eb74fb925ad81e24f1214fcc64b

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
2031c3176ac7872428fdbe9d6576628d

SHA1
60732e7200f56723bcb15cdfa5ada2a355968e80

SHA256
3f00fb20bfca49d3cc99474bcc8ca0fcbf06005db7a919698e1db8e42e5bde26

SHA512
27fbe28a142da050c6d3ed7a4cad9d4e796d33334286e6431f5cf1c18f6a791647d0a54f8cc2fadfc2683816d0147c517cb03cc9dc705c22f8bdde05c344d920

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
32KB

MD5
fc2d9084248c985c63c61bc3ff1db6f3

SHA1
2cdb47e4888c7aaf73563b96332f7aa2a63f7a3f

SHA256
3908b464064666daa4d766830eb5031d8cd2586379ed7987db2f91f47077359d

SHA512
a6cf3f7181c5c4727f86c2419efb944ced4f659cc05a66cb7f4f8cbf3f8895dff2b28f78ba64e17323bdcfe95390f9060d8988b9f284c325fc78db2ff42c6e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
41KB

MD5
dc2c0897cefbda2c95e845879000bb9d

SHA1
4020273b2bcf7af1c3cf6fe76c366204a7bfd673

SHA256
764fc0326599886bf651dfe9eee429179419925e593e87adaa0ac9410a666614

SHA512
d73b77b123fc158bf8eacf2b89822ce3e1b2088c7f8c0ff0b51c2d18b374671c8eaec7d084ae0a0fdd4c1d7cd6b9750341dd256e51815183bf8890652fb6a479

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
1KB

MD5
e63a7c029300ad9025a6af766763f65c

SHA1
f9c0f5ac4786af176b0f7d9fe6556a9d4226159a

SHA256
3604434e4961435adc19ab5a701472e4f7f8e8b4eabee26e128d795310b408b6

SHA512
2510bfee2e4d2a7e6641512b3bd4c6f7feb8ad9e94649ac9de85fae612f8cd43cfc57b620c9154802b105af356db9d07894ed122d745ebeb9d08f2339b9eb930

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
28KB

MD5
b7047bc035412e369608cac25b1ee9af

SHA1
1b9124dcd6ce9767d76aba08e0f2c32ac1f6703a

SHA256
0e41e90500adddc890b72004363947847dc1c359cb158471ef511c697f4f47f2

SHA512
34fbf1a7285001da443d1c89ff3fdedce1b308ea9879e339625455a0afab5e1dcdb42452df82d696f1a8d323f574d8f60095926d9d2aa438afb3233f9781b8cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
604B

MD5
097bcb73688e77a53af37f2e97f6cc13

SHA1
4df3c383848e5d991bbc3e82af3b465f0b4ded7e

SHA256
6aab3066c8447c434dd9bad1e3d1cffaa346082518de8ba406d41111c45513cc

SHA512
85b05ca01fa191fdbbf885caba61e150557eb270d41784b0bcd814fefa09973a7bc39459539b76f16a4bd8595ec58ad596e04c5f4a9ffcdaa59628e211001f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
f7ea17fc0a577104c57a78fb05719271

SHA1
1c0e043ee6bec590c6c9e45be2cb0f1c6cfee2c4

SHA256
00c1d488ff6e08741aac9d96fde03795afb8501584ed41e2c8c76935f7a363d7

SHA512
abf566e7508396b925edf7c36aea9dd7f868c2cc2263bf8d3056466ecce670dd45b20a7645b847ae392ec7168b92cc7832e1f4bd32e24c8f2a7ac3aa65ecee35

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
43KB

MD5
7b08c3e775198018b22ad067c354a1a1

SHA1
cd56fcc7bde9b581500f80ecaeda9e256e231159

SHA256
4a22f096df2c2e6dafa82f2f3ee11c269544d3871bcc0236e441edc811598429

SHA512
b17e45c543556cdf0f04ae9075c6841c1527418b7d431cd49338badea911975e95acdcf5564620ad8cb605e49e72301084e954ed0a71039fc17722f49a90f1b2

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\update.exe

Filesize
72KB

MD5
ff12727c200929b657bfa541d04e6cac

SHA1
c5870f374efa67d2402a33b1bfb7be6c2758338a

SHA256
249f8a1a7f5659e9eec6cff950decdacba0f47c9dc6c7fc785787ba742b5070c

SHA512
c19dd2e2bca39d0f52a5ae03a82d9dcde0669979de6307b2e636bfc3621924688d28834a7d58af568521bdc8e158ebc3f3e0a24aeaa88494e11948ad443e6bdd

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\update.exe

Filesize
3KB

MD5
45bd31732f22f6645eb63af47d0dbd54

SHA1
aade1c9b9e4d964d1a69e7bca5c68cd3e4ad82f0

SHA256
3cd434c72fcfd6959cd7d0bab6853fc1a7c746acc4878ca5104c239a9865f8a0

SHA512
3af55e4c1cbda1ee829157521a6ce431fa4f80885a977134f05a233a0113a2d53205b1692eef5e90ed15d9e32a3c6956f984910ecc44ffa477e276b24b33a1f4

Download Submit
\Users\Admin\AppData\Local\Temp\525180881\backup.exe

Filesize
16KB

MD5
9eeeef8284c42eaea3200c821f0e775c

SHA1
6f65e26362816e7013d3055deb44184196f09ce7

SHA256
8948ec3a4670ff23e0cb5b71180ec121f31cfd8665992cd4faa329515434b917

SHA512
391fa4b2de56e20bb006660203853b73d9fd720e0e77457ca86962f4a78a219f7e6f4531529e2b8fd3f990cfeef5d7adfbd108ef8794e5339685532abacebcf0

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8eb37157cec4b10a6590e7497dcd9266

SHA1
2e866ba5a420ab0df57394b847d906a75862581c

SHA256
20d6c2f26e763fa6f393b1af1944d7037cee981e0bbf0da84a771e3a6438c84b

SHA512
1b26c7eb3bd3a3319c75ad3ffef0d95802d95384142c5923637d8bd148c6f918367cc9b8618436d649deabde03cb3a4a2987b45c8881a82ea68e85bd5409917b

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
9KB

MD5
87ba585131eb7a1ac739bc724c11f7fb

SHA1
b516e711e6c89dff24761b94e2392a32e697c109

SHA256
c18e08c4a1e195254c4303f17ce24e157aea3d2938a6fddd42f8330b08da2f49

SHA512
97f466d0dbcc61387fd355eed0759bd30f69c8b73f2871eb4233544c78af577a374551aaa4840c5afa0d0b49cb778c776c3dbadddb44d679cfbcb2c173590f62

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
43KB

MD5
8ec3c925eb2fb92a22a7550d9db71e68

SHA1
2c2973559f1ad0a6286664352278db5b6efc3f16

SHA256
039f92d407d90d69ad7d3ce221fee894567b6b194cca187824fd3395f55ac43c

SHA512
4fd15957e2ddd64d30a6cca0838eda68ac0ea7d3c06418c8817b264f432798dc5239b6d9c24fcfeea23849dde5cc10f56ab8ac94efcb9604499057f3cc5f5768

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
12KB

MD5
96fd17a89690e3d3936827fe5f65f93b

SHA1
f06ede30b4fee55e0b5a100d98b28808dd45bc24

SHA256
b8986c706ebadd477bf0f046a86b5adfcf5bb2defbe7152206f3dda504b59bc4

SHA512
4d7af1ceadf2e7f6090f4b274acd24a231ff0bc46f95640917a6012d48fa0f9197a5e65589abf93a3034e2ba281f722d109628cc5b8c031c351dc6bad69c20e9

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
5KB

MD5
afcb48bd789e7b832e96abd776a93e6f

SHA1
1041e2cc1f3c4b64a929d88f6c3b0e55463f7d14

SHA256
4c0d102019e183af45ef00d3feac9d7dc0167ddebde98a48b7d5299a8c9c69b5

SHA512
a298a7b45dfe6bbf908411ff45ba02434ea241a7f95699fc148287dc6790ea0ad55237f71ee08494e53fd8f28e16cd746dff1e7f751641c8fbb43f7dac8161c8

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
34KB

MD5
e23e6fd25b3d882b833cd00424fb11ae

SHA1
d4687880d033ccd46ba2c008db0f54e780a24e84

SHA256
32ee035d9dd4f6aa482dab1c42a4f119803e8330a4d698fcf184120baea39ff8

SHA512
90a399a8640353473ae6e99e959d94f84e9d2378b06309330c0d7fef197d5fd356e72679f3b2efa941d9a493b937e4385385014e5f95173293b83d7ed39cc5f8

Download Submit
memory/2112-79-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads