25ff72201d15e0fc9e050fb02a98c836d0a2f568738e2cf953b1a6f59f63d010

Analysis

max time kernel
0s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b9712a9533d42d725e6b96f6697c997.exe
Size

72KB
MD5

1b9712a9533d42d725e6b96f6697c997
SHA1

8d3f2cf8102b0061197c46da119f3c9a3012118b
SHA256

25ff72201d15e0fc9e050fb02a98c836d0a2f568738e2cf953b1a6f59f63d010
SHA512

cd40d0e64a797baaf38efb5a0fdc8283bed944aac73944e8c138d0bd4fabf50e2be90b0f6ee036f4c8b1e97b3148a2af84b570a709bf4aefdac00d6c0af90180
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2O:ipQNwC3BEddsEqOt/hyJF+x3BEJwRri

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 4 IoCs

pid	Process
1732	backup.exe
2456	backup.exe
2116	backup.exe
2736	backup.exe

Loads dropped DLL 8 IoCs

pid	Process
1968	backup.exe
1968	backup.exe
1968	backup.exe
1968	backup.exe
1968	backup.exe
1968	backup.exe
1968	backup.exe
1968	backup.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1968	backup.exe
1732	backup.exe
2456	backup.exe
2116	backup.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1732	1968	backup.exe	750
PID 1968 wrote to memory of 1732	1968	backup.exe	750
PID 1968 wrote to memory of 1732	1968	backup.exe	750
PID 1968 wrote to memory of 1732	1968	backup.exe	750
PID 1968 wrote to memory of 2456	1968	backup.exe	749
PID 1968 wrote to memory of 2456	1968	backup.exe	749
PID 1968 wrote to memory of 2456	1968	backup.exe	749
PID 1968 wrote to memory of 2456	1968	backup.exe	749
PID 1968 wrote to memory of 2116	1968	backup.exe	748
PID 1968 wrote to memory of 2116	1968	backup.exe	748
PID 1968 wrote to memory of 2116	1968	backup.exe	748
PID 1968 wrote to memory of 2116	1968	backup.exe	748
PID 1968 wrote to memory of 2736	1968	backup.exe	790
PID 1968 wrote to memory of 2736	1968	backup.exe	790
PID 1968 wrote to memory of 2736	1968	backup.exe	790
PID 1968 wrote to memory of 2736	1968	backup.exe	790

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\1b9712a9533d42d725e6b96f6697c997.exe
"C:\Users\Admin\AppData\Local\Temp\1b9712a9533d42d725e6b96f6697c997.exe"
1⤵
PID:1968
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2776

C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
1⤵
PID:612

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
1⤵
PID:1788

C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
1⤵
PID:2504

C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
1⤵
PID:2112

C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
1⤵
PID:844

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
1⤵
PID:1324

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
1⤵
PID:2144
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:1860
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
  2⤵
  PID:2544
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
  2⤵
  PID:2548
- C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
  2⤵
  PID:2192
- C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
  2⤵
  PID:2656
- C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
  2⤵
  PID:1248
- C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
  2⤵
  PID:2764

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
1⤵
PID:2740

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
1⤵
PID:2952

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
1⤵
PID:2592
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\
  2⤵
  PID:3012
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\
  2⤵
  PID:1508

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:820

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
1⤵
PID:3012

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
1⤵
PID:1316

C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
1⤵
PID:2256

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
1⤵
PID:1620

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
1⤵
PID:2088

C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
1⤵
PID:2100

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
1⤵
PID:1760

C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
1⤵
PID:2936

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
1⤵
PID:2680

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2544

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:2756

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
1⤵
PID:2548

C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
1⤵
PID:2988

C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
1⤵
PID:3016

C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
1⤵
PID:1296

C:\Program Files\Common Files\Microsoft Shared\VC\update.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\update.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:2220

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
1⤵
PID:2856

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
1⤵
PID:560

C:\Program Files\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
1⤵
PID:112

C:\Program Files\Common Files\System\ja-JP\backup.exe
"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
1⤵
PID:1060

C:\Program Files\Common Files\System\msadc\backup.exe
"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
1⤵
PID:1860
- C:\Program Files\Common Files\System\msadc\en-US\backup.exe
  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
  2⤵
  PID:2880
- - C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
    3⤵
    PID:2648
- C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
  "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
  2⤵
  PID:2176
- C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
  2⤵
  PID:2792
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
    3⤵
    PID:2608
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
    3⤵
    PID:2548
- C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
  2⤵
  PID:2608
- C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
  2⤵
  PID:1312
- C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
  2⤵
  PID:2548

C:\Program Files\Common Files\System\it-IT\backup.exe
"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
1⤵
PID:2012

C:\Program Files\Common Files\System\fr-FR\backup.exe
"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
1⤵
PID:3032

C:\Program Files\Common Files\System\es-ES\backup.exe
"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
1⤵
PID:692

C:\Program Files\Common Files\System\en-US\System Restore.exe
"C:\Program Files\Common Files\System\en-US\System Restore.exe" C:\Program Files\Common Files\System\en-US\
1⤵
PID:1324

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
1⤵
PID:1928

C:\Program Files\Common Files\System\Ole DB\fr-FR\update.exe
"C:\Program Files\Common Files\System\Ole DB\fr-FR\update.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
1⤵
PID:2988
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
  2⤵
  PID:2396
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
    3⤵
    PID:2664
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
    3⤵
    PID:3068
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
  2⤵
  PID:2656

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:1608
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
  2⤵
  PID:2756

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:2928
- C:\Program Files\DVD Maker\en-US\backup.exe
  "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
  2⤵
  PID:768
- C:\Program Files\DVD Maker\ja-JP\backup.exe
  "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
  2⤵
  PID:2236
- C:\Program Files\DVD Maker\Shared\backup.exe
  "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
  2⤵
  PID:280
- - C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
    3⤵
    PID:676

C:\Program Files\Common Files\System\Ole DB\ja-JP\update.exe
"C:\Program Files\Common Files\System\Ole DB\ja-JP\update.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
1⤵
PID:632

C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
1⤵
PID:1112

C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
1⤵
PID:2088

C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
1⤵
PID:1760

C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
1⤵
PID:320

C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
1⤵
PID:2936
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:336
- - C:\Program Files (x86)\Google\CrashReports\backup.exe
    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
    3⤵
    PID:1632
- - C:\Program Files (x86)\Google\Temp\backup.exe
    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
    3⤵
    PID:2196
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
      4⤵
      PID:1372
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
      4⤵
      PID:1488
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
      4⤵
      PID:1924
- - C:\Program Files (x86)\Google\Update\backup.exe
    "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
    3⤵
    PID:1332
  - - C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Google\Update\Download\backup.exe
      "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
      4⤵
      PID:768
    - - C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\System Restore.exe
        
        "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\System Restore.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
        5⤵
        
        PID:112
  - - C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
      4⤵
      PID:2884
  - - C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
      4⤵
      PID:540
  - - C:\Program Files (x86)\Google\Update\Install\backup.exe
      "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
      4⤵
      PID:808
  - - C:\Program Files (x86)\Google\Update\Offline\backup.exe
      "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
      4⤵
      PID:2276
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:2460
- C:\Program Files (x86)\Common Files\backup.exe
  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
  2⤵
  PID:2124
- - C:\Program Files (x86)\Common Files\System\backup.exe
    "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
    3⤵
    PID:2928
- C:\Program Files (x86)\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:2872

C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
1⤵
PID:2680

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
1⤵
PID:2372
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
  2⤵
  PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
    3⤵
    PID:1936

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:1852

C:\Program Files\Internet Explorer\SIGNUP\backup.exe
"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
1⤵
PID:864
- C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\data.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\data.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
  2⤵
  PID:1372

C:\Program Files\Java\jdk1.7.0_80\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
1⤵
PID:2632
- C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
  2⤵
  PID:2396

C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
1⤵
PID:1344

C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
1⤵
PID:1748

C:\Program Files\Java\jdk1.7.0_80\include\win32\data.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\data.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
1⤵
PID:1284

C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
1⤵
PID:1504

C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
1⤵
PID:2724
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
  2⤵
  PID:2084
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
  2⤵
  PID:2564
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
    3⤵
    PID:2144
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
      4⤵
      PID:2676
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
      4⤵
      PID:2536
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
      4⤵
      PID:2672
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
      4⤵
      PID:2756
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
      4⤵
      PID:2880
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
      4⤵
      PID:2680
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
  2⤵
  PID:2672
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
    3⤵
    PID:1788
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
    3⤵
    PID:2016
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
    3⤵
    PID:1664
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
    3⤵
    PID:2256
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
    3⤵
    PID:1332

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
1⤵
PID:2108
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
  2⤵
  PID:964
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
    3⤵
    PID:2260

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
1⤵
PID:2412

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
1⤵
PID:2820

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2636

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
1⤵
PID:1928
- C:\Program Files\Java\jre7\lib\backup.exe
  "C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
  2⤵
  PID:1676
- - C:\Program Files\Java\jre7\lib\management\backup.exe
    "C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
    3⤵
    PID:1476
- - C:\Program Files\Java\jre7\lib\zi\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
    3⤵
    PID:860
  - - C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
      4⤵
      PID:2240
  - - C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
      4⤵
      PID:2924
  - - C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
      4⤵
      PID:2468
  - - C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
      4⤵
      PID:1312
  - - C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
      4⤵
      PID:2928
- C:\Program Files\Java\jre7\bin\backup.exe
  "C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
  2⤵
  PID:2368

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\
1⤵
PID:2124
- C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
  "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
  2⤵
  PID:2408
- C:\Program Files (x86)\Common Files\Services\backup.exe
  "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
  2⤵
  PID:592
- C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
  "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
  2⤵
  PID:2560
- - C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
    "C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
    3⤵
    PID:764
- C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
  2⤵
  PID:944
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
    3⤵
    PID:1036
- C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
  2⤵
  PID:1804
- C:\Program Files (x86)\Common Files\Adobe\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
  2⤵
  PID:3068
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\System Restore.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
    3⤵
    PID:1676
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
    3⤵
    PID:452
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
    3⤵
    PID:996
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
    3⤵
    PID:1808

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:1700

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2372

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
1⤵
PID:2856

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:1848
- C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
  2⤵
  PID:1280
- C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
  2⤵
  PID:2900

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
1⤵
PID:2432

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\
1⤵
PID:112

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
1⤵
PID:1748

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
1⤵
PID:1480
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
  2⤵
  PID:1532
- C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
  2⤵
  PID:1396
- C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
  2⤵
  PID:1192
- C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
  2⤵
  PID:112
- - C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
    "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
    3⤵
    PID:2744
- C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
  2⤵
  PID:2248
- C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
  2⤵
  PID:2340
- C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
  2⤵
  PID:2512
- C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
  2⤵
  PID:676
- C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
  2⤵
  PID:2236
- C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
  2⤵
  PID:2488
- C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
  2⤵
  PID:1508
- C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
  2⤵
  PID:1644
- C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
  2⤵
  PID:1792
- C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
  2⤵
  PID:2984
- C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
  2⤵
  PID:2552
- C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
  2⤵
  PID:328
- - C:\Windows\Branding\backup.exe
    C:\Windows\Branding\backup.exe C:\Windows\Branding\
    3⤵
    PID:2960
- - C:\Windows\CSC\backup.exe
    C:\Windows\CSC\backup.exe C:\Windows\CSC\
    3⤵
    PID:1012
- - C:\Windows\Cursors\update.exe
    C:\Windows\Cursors\update.exe C:\Windows\Cursors\
    3⤵
    PID:1484
- - C:\Windows\debug\backup.exe
    C:\Windows\debug\backup.exe C:\Windows\debug\
    3⤵
    PID:2856
- - C:\Windows\de-DE\backup.exe
    C:\Windows\de-DE\backup.exe C:\Windows\de-DE\
    3⤵
    PID:820
- - C:\Windows\DigitalLocker\backup.exe
    C:\Windows\DigitalLocker\backup.exe C:\Windows\DigitalLocker\
    3⤵
    PID:940
- C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
  2⤵
  PID:3032
- C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
  2⤵
  PID:2316
- C:\Program Files\Common Files\Microsoft Shared\ink\en-US\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
  2⤵
  PID:1052
- C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
  2⤵
  PID:1356
- C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
  2⤵
  PID:1532

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
1⤵
PID:1324
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
  2⤵
  PID:2928
- - C:\Program Files\DVD Maker\it-IT\backup.exe
    "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
    3⤵
    PID:2060
- - C:\Program Files\DVD Maker\fr-FR\backup.exe
    "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
    3⤵
    PID:2232
- - C:\Program Files\DVD Maker\es-ES\backup.exe
    "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
    3⤵
    PID:2120
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\
  2⤵
  PID:2824
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
  2⤵
  PID:2156

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
1⤵
PID:3032
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
  2⤵
  PID:1060
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
  2⤵
  PID:2848
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
  2⤵
  PID:3040
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\
    3⤵
    PID:2920
- - C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
    3⤵
    PID:2140

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
1⤵
PID:2976

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
1⤵
PID:2772

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
1⤵
PID:2232
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
  2⤵
  PID:2992

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
1⤵
PID:580

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
1⤵
PID:1476

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
1⤵
PID:1424

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
1⤵
PID:996
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
  2⤵
  PID:1784
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
  2⤵
  PID:584
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
  2⤵
  PID:488
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
  2⤵
  PID:2220
- - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe
    "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\
    3⤵
    PID:1972
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
  2⤵
  PID:1412
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
  2⤵
  PID:1608
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:1792
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:2520
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
  2⤵
  PID:3004
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
  2⤵
  PID:2960
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:2192
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
  2⤵
  PID:2792
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
  2⤵
  PID:2828
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
  2⤵
  PID:2872
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
  2⤵
  PID:2736
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
  2⤵
  PID:2800
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
  2⤵
  PID:2644
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
  2⤵
  PID:2460
- - C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
    3⤵
    PID:2224
- - C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
    "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
    3⤵
    PID:2708
- - C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
    "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
    3⤵
    PID:1936
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
  2⤵
  PID:2280
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
  2⤵
  PID:960
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
  2⤵
  PID:1068

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
1⤵
PID:2088
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\
  2⤵
  PID:2872
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
  2⤵
  PID:3060
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
  2⤵
  PID:240
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
  2⤵
  PID:964

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
1⤵
PID:3044

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
1⤵
PID:2900

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:2684

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
1⤵
PID:1312

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
1⤵
PID:2836
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
  2⤵
  PID:2980

C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
"C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
1⤵
PID:1524

C:\Program Files\Java\jre7\bin\server\backup.exe
"C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
1⤵
PID:2324

C:\Program Files\Java\jre7\lib\amd64\backup.exe
"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
1⤵
PID:1792

C:\Program Files\Java\jre7\lib\applet\data.exe
"C:\Program Files\Java\jre7\lib\applet\data.exe" C:\Program Files\Java\jre7\lib\applet\
1⤵
PID:2424

C:\Program Files\Java\jre7\lib\cmm\backup.exe
"C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
1⤵
PID:2532

C:\Program Files\Java\jre7\lib\deploy\backup.exe
"C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\
1⤵
PID:292

C:\Program Files\Java\jre7\lib\fonts\backup.exe
"C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\
1⤵
PID:852

C:\Program Files\Java\jre7\lib\images\backup.exe
"C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
1⤵
PID:1260
- C:\Program Files\Java\jre7\lib\images\cursors\backup.exe
  "C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\
  2⤵
  PID:2256

C:\Program Files\Java\jre7\lib\ext\backup.exe
"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
1⤵
PID:1968

C:\Program Files\Java\jre7\bin\plugin2\backup.exe
"C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
1⤵
PID:2964

C:\Program Files\Java\jre7\lib\zi\Africa\data.exe
"C:\Program Files\Java\jre7\lib\zi\Africa\data.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
1⤵
PID:2416

C:\Program Files\Java\jre7\lib\zi\America\System Restore.exe
"C:\Program Files\Java\jre7\lib\zi\America\System Restore.exe" C:\Program Files\Java\jre7\lib\zi\America\
1⤵
PID:1332
- C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
  2⤵
  PID:884
- C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
  2⤵
  PID:964

C:\Program Files\Microsoft Games\Chess\backup.exe
"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
1⤵
PID:2548
- C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
  2⤵
  PID:1744
- C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\
  2⤵
  PID:1496
- - C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
    3⤵
    PID:2592
- C:\Program Files\Microsoft Games\Chess\ja-JP\update.exe
  "C:\Program Files\Microsoft Games\Chess\ja-JP\update.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
  2⤵
  PID:1296
- C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
  2⤵
  PID:1700
- C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
  2⤵
  PID:1444
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
    3⤵
    PID:2700
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
    3⤵
    PID:2148
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\
    3⤵
    PID:2792
- C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
  2⤵
  PID:2648

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
1⤵
PID:2876

C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
1⤵
PID:852

C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
1⤵
PID:1104

C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
1⤵
PID:1920

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
1⤵
PID:1856
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
  2⤵
  PID:1952

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
1⤵
PID:2140
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
  2⤵
  PID:3044
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
    3⤵
    PID:3052
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
    3⤵
    PID:2408

C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
1⤵
PID:2240

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
1⤵
PID:2692
- C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
  2⤵
  PID:2608
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
    3⤵
    PID:1696
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
      4⤵
      PID:2016
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
      4⤵
      PID:1632
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
    3⤵
    PID:2436

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
1⤵
PID:1996

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
1⤵
PID:1676
- C:\Program Files\Java\jre7\lib\security\backup.exe
  "C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
  2⤵
  PID:1320
- C:\Program Files\Java\jre7\lib\jfr\update.exe
  "C:\Program Files\Java\jre7\lib\jfr\update.exe" C:\Program Files\Java\jre7\lib\jfr\
  2⤵
  PID:1752
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
  2⤵
  PID:1196
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
  2⤵
  PID:2600
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
  2⤵
  PID:2816

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
1⤵
PID:1304
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
  2⤵
  PID:2200

C:\Program Files\Microsoft Games\Minesweeper\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\
1⤵
PID:2188
- C:\Program Files\Microsoft Games\Minesweeper\de-DE\update.exe
  "C:\Program Files\Microsoft Games\Minesweeper\de-DE\update.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
  2⤵
  PID:1924
- C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
  2⤵
  PID:2256
- C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
  2⤵
  PID:2508
- C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
  2⤵
  PID:1544
- C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
  2⤵
  PID:1344
- C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
  2⤵
  PID:1424

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
1⤵
PID:1536
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
  2⤵
  PID:884
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
    3⤵
    PID:776
- C:\Program Files\VideoLAN\VLC\locale\ach\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\data.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
  2⤵
  PID:1996
- - C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
    3⤵
    PID:1972
- C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
  2⤵
  PID:1908
- - C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
    3⤵
    PID:2664
- C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
  2⤵
  PID:1792
- - C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
    3⤵
    PID:1976
- C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
  2⤵
  PID:1788
- - C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
    3⤵
    PID:2224
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
    3⤵
    PID:1976
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
    3⤵
    PID:2196
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
    3⤵
    PID:2664
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
    3⤵
    PID:1624
- C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
  2⤵
  PID:1412
- - C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
    3⤵
    PID:2432
- C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
  2⤵
  PID:844
- - C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
    3⤵
    PID:1372
- C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
  2⤵
  PID:2884
- - C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
    3⤵
    PID:2992
- C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
  2⤵
  PID:2692
- - C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
    3⤵
    PID:2408
- C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\
  2⤵
  PID:1268
- - C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
    3⤵
    PID:2628
- C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
  2⤵
  PID:2968
- C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
  2⤵
  PID:240
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\
    3⤵
    PID:2716
- C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
  2⤵
  PID:2880

C:\Program Files\Microsoft Games\More Games\System Restore.exe
"C:\Program Files\Microsoft Games\More Games\System Restore.exe" C:\Program Files\Microsoft Games\More Games\
1⤵
PID:1168
- C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
  2⤵
  PID:2456
- C:\Program Files\Microsoft Games\More Games\en-US\backup.exe
  "C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\
  2⤵
  PID:2732
- C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
  2⤵
  PID:2736
- C:\Program Files\Microsoft Games\More Games\fr-FR\data.exe
  "C:\Program Files\Microsoft Games\More Games\fr-FR\data.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
  2⤵
  PID:2848
- C:\Program Files\Microsoft Games\More Games\it-IT\update.exe
  "C:\Program Files\Microsoft Games\More Games\it-IT\update.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
  2⤵
  PID:2720
- C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
  2⤵
  PID:2608

C:\Program Files\Microsoft Games\Multiplayer\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
1⤵
PID:2476
- C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
  2⤵
  PID:2164

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
1⤵
PID:2700

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
1⤵
PID:2204
- C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
  2⤵
  PID:1660
- - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
    3⤵
    PID:1988

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
1⤵
PID:1748
- C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
  2⤵
  PID:540

C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
1⤵
PID:2992

C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
1⤵
PID:2660
- C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
  2⤵
  PID:2096

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
1⤵
PID:1948

C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\
1⤵
PID:2632
- C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
  2⤵
  PID:1764
- C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
  2⤵
  PID:808
- C:\Program Files\Java\jdk1.7.0_80\db\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\db\
  2⤵
  PID:540
- C:\Program Files\Java\jdk1.7.0_80\bin\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\bin\data.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
  2⤵
  PID:2624

C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
1⤵
PID:1444
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
  2⤵
  PID:1556
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
  2⤵
  PID:1520
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
  2⤵
  PID:2272
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
  2⤵
  PID:2784
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
  2⤵
  PID:1476
- C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
  2⤵
  PID:808
- C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
  2⤵
  PID:292
- - C:\Program Files\VideoLAN\VLC\backup.exe
    "C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
    3⤵
    PID:1848
  - - C:\Program Files\VideoLAN\VLC\locale\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
      4⤵
      PID:1536
    - - C:\Program Files\MSBuild\Microsoft\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
        5⤵
        
        PID:760
  - - C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
      "C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
      4⤵
      PID:2932
  - - C:\Program Files\VideoLAN\VLC\lua\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
      4⤵
      PID:2292
    - - C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
        5⤵
        
        PID:2736
    - - C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
        5⤵
        
        PID:2996
      - C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
        6⤵
        
        PID:1508
    - - C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
        5⤵
        
        PID:1308
    - - C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
        5⤵
        
        PID:2776
    - - C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
        5⤵
        
        PID:2656
    - - C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
        5⤵
        
        PID:884
    - - C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
        5⤵
        
        PID:2868
  - - C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\
      4⤵
      PID:540
  - - C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\
      4⤵
      PID:964
  - - C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
      4⤵
      PID:1544
  - - C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
      4⤵
      PID:792
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
  2⤵
  PID:1920
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
  2⤵
  PID:2052
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\
  2⤵
  PID:272
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\
  2⤵
  PID:2872
- - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
    3⤵
    PID:2972

C:\Program Files\Microsoft Games\Purble Place\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\
1⤵
PID:2148

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
1⤵
PID:2732

C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\
1⤵
PID:2156

C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
1⤵
PID:2640

C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\update.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
1⤵
PID:2244

C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
1⤵
PID:2736

C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
1⤵
PID:2680
- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
  2⤵
  PID:2880

C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
1⤵
PID:2524

C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
1⤵
PID:2516
- C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
  2⤵
  PID:1424

C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
1⤵
PID:2648

C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\
1⤵
PID:3004
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
  2⤵
  PID:1068
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\update.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
  2⤵
  PID:760
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
  2⤵
  PID:832
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
  2⤵
  PID:596

C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
1⤵
PID:2780

C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\
1⤵
PID:3008

C:\Program Files\Microsoft Office\Office14\data.exe
"C:\Program Files\Microsoft Office\Office14\data.exe" C:\Program Files\Microsoft Office\Office14\
1⤵
PID:2700
- C:\Program Files\Microsoft Office\Office14\1033\backup.exe
  "C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
  2⤵
  PID:820
- C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
  2⤵
  PID:2552

C:\Program Files\Microsoft Office\backup.exe
"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
1⤵
PID:1540

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:2984
- C:\Program Files\Mozilla Firefox\browser\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
  2⤵
  PID:2772
- - C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
    3⤵
    PID:3020
- - C:\Program Files\Mozilla Firefox\browser\features\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
    3⤵
    PID:2020
- C:\Program Files\Mozilla Firefox\fonts\backup.exe
  "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
  2⤵
  PID:1644
- C:\Program Files\Mozilla Firefox\uninstall\backup.exe
  "C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
  2⤵
  PID:1052
- C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
  2⤵
  PID:864
- C:\Program Files\Mozilla Firefox\defaults\backup.exe
  "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
  2⤵
  PID:1704

C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\
1⤵
PID:380

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
1⤵
PID:2148
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
  2⤵
  PID:1040
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
  2⤵
  PID:2920
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
  2⤵
  PID:808
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
  2⤵
  PID:2260
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
  2⤵
  PID:1476
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
  2⤵
  PID:2672
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
    3⤵
    PID:1308
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
    3⤵
    PID:1752
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
    3⤵
    PID:2224
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
    3⤵
    PID:1296
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
    3⤵
    PID:1436
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
    3⤵
    PID:2984
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
    3⤵
    PID:2572
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
    3⤵
    PID:1928
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
    3⤵
    PID:2676
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
    3⤵
    PID:2536
- C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
  2⤵
  PID:2016
- C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe
    C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\backup.exe
    C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
    C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
    3⤵
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
    3⤵
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\3593799436\backup.exe
    C:\Users\Admin\AppData\Local\Temp\3593799436\backup.exe C:\Users\Admin\AppData\Local\Temp\3593799436\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1732
- C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
  2⤵
  PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
    3⤵
    PID:2756
  - - C:\Program Files\Google\Chrome\Application\backup.exe
      "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
      4⤵
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe
        
        C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\
        5⤵
        
        PID:2536
- C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\
  2⤵
  PID:2988
- C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
  2⤵
  PID:2772
- C:\Program Files\Microsoft Games\Purble Place\de-DE\update.exe
  "C:\Program Files\Microsoft Games\Purble Place\de-DE\update.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
  2⤵
  PID:2552
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
  2⤵
  PID:2816
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
    3⤵
    PID:2796
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
    3⤵
    PID:2940
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
    3⤵
    PID:2540

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
1⤵
PID:2460
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
  2⤵
  PID:2668
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
  2⤵
  PID:2788

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
1⤵
PID:2924
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\
  2⤵
  PID:1312
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
  2⤵
  PID:2568
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
  2⤵
  PID:764
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\
    3⤵
    PID:2164
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
      4⤵
      PID:1668
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
        5⤵
        
        PID:2792
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
        5⤵
        
        PID:1264
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
        5⤵
        
        PID:1948
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
      4⤵
      PID:2892
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
        5⤵
        
        PID:2072
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
        5⤵
        
        PID:2248
      - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
        6⤵
        
        PID:1396
      - C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        6⤵
        
        PID:1760
      - C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        6⤵
        
        PID:1192
      - C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        6⤵
        
        PID:2100
      - C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        6⤵
        
        PID:2088
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\
      4⤵
      PID:2676
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
      4⤵
      PID:1628
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
      4⤵
      PID:1500
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
      4⤵
      PID:2640
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
    3⤵
    PID:2740
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\
    3⤵
    PID:2044
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
    3⤵
    PID:2964
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\
    3⤵
    PID:3020
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
    3⤵
    PID:640
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
    3⤵
    PID:1476
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\
    3⤵
    PID:2412
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
    3⤵
    PID:2056
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
    3⤵
    PID:540
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
    3⤵
    PID:2260
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
    3⤵
    PID:1296
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
    3⤵
    PID:584
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
    3⤵
    PID:2120
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\
    3⤵
    PID:2176
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
    3⤵
    PID:2812
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\
    3⤵
    PID:2252
  - - C:\Program Files\Java\jre7\backup.exe
      "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
      4⤵
      PID:1928

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
1⤵
PID:2520

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
1⤵
PID:860
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
  2⤵
  PID:2476
- - C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\
    3⤵
    PID:596
- - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
    3⤵
    PID:2592
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
  2⤵
  PID:2252
- C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
  2⤵
  PID:2104
- C:\Program Files\Java\jre7\lib\zi\Europe\update.exe
  "C:\Program Files\Java\jre7\lib\zi\Europe\update.exe" C:\Program Files\Java\jre7\lib\zi\Europe\
  2⤵
  PID:2640
- C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
  2⤵
  PID:944
- - C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
    3⤵
    PID:1632
- C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
  2⤵
  PID:1532

C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
1⤵
PID:2864

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
1⤵
PID:2268
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
  2⤵
  PID:1000
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
  2⤵
  PID:2292
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\
  2⤵
  PID:1588
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\
  2⤵
  PID:1844
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\
  2⤵
  PID:2592
- - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
    3⤵
    PID:2144
  - - C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
      4⤵
      PID:620
  - - C:\Program Files\Microsoft Games\Mahjong\en-US\update.exe
      "C:\Program Files\Microsoft Games\Mahjong\en-US\update.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
      4⤵
      PID:820
- - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\
    3⤵
    PID:2596
- - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\
    3⤵
    PID:2988
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\data.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
      4⤵
      PID:2772
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
        5⤵
        
        PID:3012
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\data.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\update.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
      4⤵
      PID:1412
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
        5⤵
        
        PID:292
      - C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
        6⤵
        
        PID:1436
      - C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
        6⤵
        
        PID:1556
      - C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
        6⤵
        
        PID:1940
      - C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
        6⤵
        
        PID:1744
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\update.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
      4⤵
      PID:2544
    - - C:\Program Files\Google\Chrome\backup.exe
        
        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
        5⤵
        
        PID:2756
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
      4⤵
      PID:1576
    - - C:\Program Files\Windows Journal\de-DE\update.exe
        
        "C:\Program Files\Windows Journal\de-DE\update.exe" C:\Program Files\Windows Journal\de-DE\
        5⤵
        
        PID:1860
    - - C:\Program Files\Windows Journal\en-US\backup.exe
        
        "C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
        5⤵
        
        PID:1748
- - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
    3⤵
    PID:2372
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
      4⤵
      PID:2956
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\data.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\data.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
      4⤵
      PID:1576
    - - C:\Program Files\Windows Journal\es-ES\backup.exe
        
        "C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
        5⤵
        
        PID:2404
    - - C:\Program Files\Windows Journal\fr-FR\backup.exe
        
        "C:\Program Files\Windows Journal\fr-FR\backup.exe" C:\Program Files\Windows Journal\fr-FR\
        5⤵
        
        PID:1980
    - - C:\Program Files\Windows Journal\it-IT\backup.exe
        
        "C:\Program Files\Windows Journal\it-IT\backup.exe" C:\Program Files\Windows Journal\it-IT\
        5⤵
        
        PID:2256
    - - C:\Program Files\Windows Journal\ja-JP\backup.exe
        
        "C:\Program Files\Windows Journal\ja-JP\backup.exe" C:\Program Files\Windows Journal\ja-JP\
        5⤵
        Executes dropped EXE
        
        PID:2736
    - - C:\Program Files\Windows Journal\Templates\backup.exe
        
        "C:\Program Files\Windows Journal\Templates\backup.exe" C:\Program Files\Windows Journal\Templates\
        5⤵
        
        PID:592
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\System Restore.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\System Restore.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
      4⤵
      PID:2808
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
      4⤵
      PID:2768
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
      4⤵
      PID:2552
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
      4⤵
      PID:1860
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
  2⤵
  PID:2728
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
  2⤵
  PID:1624

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
1⤵
PID:2256

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
1⤵
PID:3060

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
1⤵
PID:2716

C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
1⤵
PID:2472

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\
1⤵
PID:1668

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\
1⤵
PID:2780

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\
1⤵
PID:2880

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
1⤵
PID:1836

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
1⤵
PID:2476
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
  2⤵
  PID:632

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
1⤵
PID:2960

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:2536
- C:\Users\Admin\backup.exe
  C:\Users\Admin\backup.exe C:\Users\Admin\
  2⤵
  PID:3008
- - C:\Users\Admin\Contacts\backup.exe
    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
    3⤵
    PID:1316
- - C:\Users\Admin\Desktop\backup.exe
    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
    3⤵
    PID:2644
- - C:\Users\Admin\Documents\backup.exe
    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
    3⤵
    PID:2664
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
      4⤵
      PID:1444
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
      4⤵
      PID:2196
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
      4⤵
      PID:900
- - C:\Users\Admin\Downloads\backup.exe
    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
    3⤵
    PID:1356
- - C:\Users\Admin\Favorites\backup.exe
    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
    3⤵
    PID:1688
- - C:\Users\Admin\Links\backup.exe
    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
    3⤵
    PID:580
- - C:\Users\Admin\Music\backup.exe
    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
    3⤵
    PID:2540
- - C:\Users\Admin\Pictures\backup.exe
    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
    3⤵
    PID:2892
- - C:\Users\Admin\Saved Games\backup.exe
    "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
    3⤵
    PID:1100
- - C:\Users\Admin\Searches\backup.exe
    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
    3⤵
    PID:1596
- C:\Users\Public\backup.exe
  C:\Users\Public\backup.exe C:\Users\Public\
  2⤵
  PID:3024
- - C:\Users\Public\Documents\backup.exe
    C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
    3⤵
    PID:2056
- - C:\Users\Public\Downloads\backup.exe
    C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
    3⤵
    PID:1900
- - C:\Users\Public\Music\backup.exe
    C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
    3⤵
    PID:2672
- - C:\Users\Public\Pictures\backup.exe
    C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
    3⤵
    PID:1264
- C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
  2⤵
  PID:2036
- C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
  2⤵
  PID:2572
- C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
  2⤵
  PID:2676

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
1⤵
PID:620

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
1⤵
PID:1508

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
1⤵
PID:2244

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
1⤵
PID:268

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
1⤵
PID:2512

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\
1⤵
PID:2640

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\
1⤵
PID:2824

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
1⤵
PID:1696
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
  2⤵
  PID:1052
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
  2⤵
  PID:1952
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
  2⤵
  PID:112
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
    3⤵
    PID:2024
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\update.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
  2⤵
  PID:1644
- - C:\Program Files\Internet Explorer\ja-JP\backup.exe
    "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
    3⤵
    PID:564
- - C:\Program Files\Internet Explorer\it-IT\backup.exe
    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
    3⤵
    PID:1752
- - C:\Program Files\Internet Explorer\images\backup.exe
    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
    3⤵
    PID:2256
- - C:\Program Files\Internet Explorer\fr-FR\backup.exe
    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
    3⤵
    PID:1992
- - C:\Program Files\Internet Explorer\es-ES\backup.exe
    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
    3⤵
    PID:2268
- - C:\Program Files\Internet Explorer\en-US\backup.exe
    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
    3⤵
    PID:276
  - - C:\PerfLogs\Admin\backup.exe
      C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
      4⤵
      PID:2120
- - C:\Program Files\Internet Explorer\de-DE\backup.exe
    "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
    3⤵
    PID:380

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
1⤵
PID:1724
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
  2⤵
  PID:1712
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
  2⤵
  PID:3020
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\
  2⤵
  PID:1100
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
  2⤵
  PID:2672
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
  2⤵
  PID:1588
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
  2⤵
  PID:1064
- C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
  2⤵
  PID:552
- C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
  2⤵
  PID:1588
- C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
  2⤵
  PID:1476
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
    3⤵
    PID:1040

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\
1⤵
PID:2636

C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\
1⤵
PID:2744

C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\
1⤵
PID:2660

C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2716

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:292

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\data.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
1⤵
PID:3000

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
1⤵
PID:2596

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:620

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:2980

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:2676

C:\Program Files\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
1⤵
PID:2692
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
  2⤵
  PID:1948

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:3024

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:284

C:\Program Files\MSBuild\data.exe
"C:\Program Files\MSBuild\data.exe" C:\Program Files\MSBuild\
1⤵
PID:1536
- C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
  2⤵
  PID:2232
- - C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
    3⤵
    PID:1628
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
    3⤵
    PID:2044
- C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
  2⤵
  PID:2552
- C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
  2⤵
  PID:1488
- C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
  2⤵
  PID:1040
- C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
  2⤵
  PID:2764
- - C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
    3⤵
    PID:2988
- C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\
  2⤵
  PID:2920
- C:\Program Files\VideoLAN\VLC\locale\co\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\
  2⤵
  PID:2108
- C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
  2⤵
  PID:1608
- C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
  2⤵
  PID:1652

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
1⤵
PID:1472

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
1⤵
PID:1496

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\
1⤵
PID:1052

C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
1⤵
PID:2760

C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\
1⤵
PID:2108
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
  2⤵
  PID:1948

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
1⤵
PID:2800

C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\
1⤵
PID:596
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\
  2⤵
  PID:1532
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\
  2⤵
  PID:1284
- - C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
    3⤵
    PID:912
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\System Restore.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\System Restore.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\
  2⤵
  PID:2504
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
  2⤵
  PID:640
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\
  2⤵
  PID:2432

C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
1⤵
PID:960

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:328
- C:\Windows\addins\backup.exe
  C:\Windows\addins\backup.exe C:\Windows\addins\
  2⤵
  PID:1616
- C:\Windows\AppCompat\backup.exe
  C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
  2⤵
  PID:2512
- C:\Windows\AppPatch\backup.exe
  C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
  2⤵
  PID:2724
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
    3⤵
    PID:2996
  - - C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
      4⤵
      PID:1504
  - - C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\images\
      4⤵
      PID:2036
  - - C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\js\
      4⤵
      PID:2888
  - - C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
      4⤵
      PID:2584
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\
    3⤵
    PID:2648
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
    3⤵
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe
      C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\
      4⤵
      PID:2552
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
    3⤵
    PID:2972
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
    3⤵
    PID:1444
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
    3⤵
    PID:2788
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
    3⤵
    PID:2244
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
    3⤵
    PID:2104

C:\Program Files\Microsoft Games\Solitaire\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
1⤵
PID:1848
- C:\Program Files\VideoLAN\VLC\plugins\update.exe
  "C:\Program Files\VideoLAN\VLC\plugins\update.exe" C:\Program Files\VideoLAN\VLC\plugins\
  2⤵
  PID:2796
- C:\Program Files\VideoLAN\VLC\skins\backup.exe
  "C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
  2⤵
  PID:2272

C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
1⤵
PID:2820

C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
1⤵
PID:1784

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
1⤵
PID:564

C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
1⤵
PID:2736

C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
1⤵
PID:2888

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
1⤵
PID:2488

C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
1⤵
PID:1976

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
1⤵
PID:1668

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
1⤵
PID:1500

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
1⤵
PID:1688
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
  2⤵
  PID:1860
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
  2⤵
  PID:1060
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
  2⤵
  PID:3052
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  PID:692
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
  2⤵
  PID:320

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
1⤵
PID:864

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
1⤵
PID:3004

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:1576

C:\Program Files\Microsoft Games\Mahjong\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
1⤵
PID:2144

C:\Program Files\Microsoft Games\Hearts\ja-JP\data.exe
"C:\Program Files\Microsoft Games\Hearts\ja-JP\data.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
1⤵
PID:1784

C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
1⤵
PID:2568

C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
1⤵
PID:2716

C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
"C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
1⤵
PID:2644

C:\Program Files\Microsoft Games\Hearts\backup.exe
"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
1⤵
PID:452
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
  2⤵
  PID:2408

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
1⤵
PID:1000

C:\Program Files\Microsoft Games\FreeCell\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
1⤵
PID:1724
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
  2⤵
  PID:1768
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\
  2⤵
  PID:2144
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
  2⤵
  PID:1004
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
  2⤵
  PID:2804
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
  2⤵
  PID:792
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\
  2⤵
  PID:848
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
  2⤵
  PID:2872
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
  2⤵
  PID:2192
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\
  2⤵
  PID:2336
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\
  2⤵
  PID:2760

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
1⤵
PID:2988

C:\Program Files\Microsoft Games\backup.exe
"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
1⤵
PID:2804

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:2936
- C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
  2⤵
  PID:2856
- - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe
    "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\
    3⤵
    PID:2220
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
      4⤵
      PID:1256
    - - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        5⤵
        
        PID:2044
- - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
    3⤵
    PID:1988
- C:\Program Files (x86)\Microsoft Office\backup.exe
  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
  "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft.NET\System Restore.exe
  "C:\Program Files (x86)\Microsoft.NET\System Restore.exe" C:\Program Files (x86)\Microsoft.NET\
  2⤵
  PID:1804
- C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
  2⤵
  PID:1708

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
1⤵
PID:2808

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
1⤵
PID:2340

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
1⤵
PID:1852

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
1⤵
PID:2556

C:\Program Files\Windows Mail\backup.exe
"C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\
1⤵
PID:2112

C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
1⤵
PID:3040

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:2252

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:1644

C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
1⤵
PID:1036

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
1⤵
PID:2340
- C:\Program Files\Common Files\System\Ole DB\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
  2⤵
  PID:2536
- C:\Program Files\Common Files\System\de-DE\backup.exe
  "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
  2⤵
  PID:944
- - C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\
    3⤵
    PID:2836
- - C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
    3⤵
    PID:560
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\
    3⤵
    PID:2196
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\
    3⤵
    PID:2712
- - C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\
    3⤵
    PID:2508
- - C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\
    3⤵
    PID:2068
- C:\Program Files\Common Files\System\ado\backup.exe
  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
  2⤵
  PID:2248

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:2544

C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
1⤵
PID:2660

C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
1⤵
PID:3060

C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
1⤵
PID:328
- C:\Windows\assembly\backup.exe
  C:\Windows\assembly\backup.exe C:\Windows\assembly\
  2⤵
  PID:2732

C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
1⤵
PID:2364

C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
1⤵
PID:960

C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
1⤵
PID:1068

C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
1⤵
PID:1192

C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
1⤵
PID:1952

C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
1⤵
PID:1804

C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
1⤵
PID:2408

C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
1⤵
PID:1264

C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
1⤵
PID:2904

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
1⤵
PID:612

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
1⤵
PID:1988

C:\Program Files\Common Files\System\backup.exe
"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
1⤵
PID:2340

C:\Program Files\Common Files\SpeechEngines\backup.exe
"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
1⤵
PID:2516

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:592

C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:1232

C:\Program Files\Windows Media Player\backup.exe
"C:\Program Files\Windows Media Player\backup.exe" C:\Program Files\Windows Media Player\
1⤵
PID:676

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:292

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:2672

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:1688

C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
1⤵
PID:1480

C:\Program Files\Common Files\Microsoft Shared\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
1⤵
PID:1984

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:2216

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
PID:1256

C:\Program Files\backup.exe
"C:\Program Files\backup.exe" C:\Program Files\
1⤵
PID:1388
- C:\Program Files\Windows NT\backup.exe
  "C:\Program Files\Windows NT\backup.exe" C:\Program Files\Windows NT\
  2⤵
  PID:900
- C:\Program Files\Windows Photo Viewer\backup.exe
  "C:\Program Files\Windows Photo Viewer\backup.exe" C:\Program Files\Windows Photo Viewer\
  2⤵
  PID:2984
- C:\Program Files\Windows Portable Devices\backup.exe
  "C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
  2⤵
  PID:1568
- C:\Program Files\Windows Sidebar\backup.exe
  "C:\Program Files\Windows Sidebar\backup.exe" C:\Program Files\Windows Sidebar\
  2⤵
  PID:2392

C:\PerfLogs\backup.exe
C:\PerfLogs\backup.exe C:\PerfLogs\
1⤵
PID:276

C:\backup.exe
\backup.exe \
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
15KB

MD5
7a189e03a636dde50a25317d42a9ae3b

SHA1
32e07d667b3472431dac43ce2408043c34cd1ffb

SHA256
7c9cd14918de8d1d82ebfa361439ecf61c7ca8db0675fea00d20c268e1966258

SHA512
8b4b8a556f579811fc4e1154210d878d27916e0fd12c99bd7a87f739d506d68ebe56088e171483cd8c3f75eb48f5431584d0761553131e445b336daec58a012f

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
19KB

MD5
ea55fd0d9e8e788920b3f00496b896cd

SHA1
6c2ec5d650430d5b1802687164b7d0f4bbf8b354

SHA256
3020e552bdf3ff1952ef2478d21bee97ce71a1450c8d910e83f86f80f3c48a79

SHA512
b44e6585f562a6199bd0fdf1340c789f2dc33d0f45f356576ac372ab75e4e121a791f1441f6df8418ba682c2884259b7b9fcec861deb0f70bad3587ade20521d

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
6a45c84fd8cca0b46f8e2918b8dad713

SHA1
42e31c1099117d379c884fee9ce9a2fcaee01e4b

SHA256
4e9cbe70fdbb53c6b9e7c119f7294d38f1563fa08788dc5181d9ecb19d369223

SHA512
2e1741f03e1457d7fc993ab02f34f3f3fbc25ae34bc081314e2ca4afe9bc488ce320e89c510a496a979179cbd1a403f6e9cd7d102d676620a4a9bd62636dd773

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
956a74806c84b8779f7f56abac1bcf40

SHA1
110143de4cb5178399fb28b975cd07f49452fbd8

SHA256
c976e2cdb694907e7a235e22112b5cc9d4758a01af252733ae146d9e64ffa4a6

SHA512
58bd6c60d009b54dd91a65148049941b9aa6cd54337c1b6e4e608e3640f4d6d407180b3d55a0558c2436c48fc1230c2452602d9951c454455bb1a4d0a86631a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\3593799436\backup.exe

Filesize
72KB

MD5
02f777099bc9ccff2004d0b3e1e00e59

SHA1
8cd6d80446d84564dbb36c671db3b728d3712728

SHA256
bb3a87e0cc6038682aa5ca5c7b4d088bac89e49ccfbea9c92e93de4d53a9fea9

SHA512
8d2b6869fcc288b9d3289ca4582cb3a7206451bc832e44a8fcf686dbf4d403f666259cb8ec89f27c6d65e5839af9d13ecd4c81bde8fac17789679464396c9bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
28KB

MD5
0320ad5aef0345ae29c9b8ca4c6e7bef

SHA1
4c694359d1b0bc48d9a5b07ceac06800cd93dc62

SHA256
73ebcc2062b2f45b69e8ac9a45424428e2091007dcb4098dfa68234fe31d9715

SHA512
a9778af1f7fdd1cec248cb0eac948187146c65bfe749e49e67ac2bc4a7a23fcaa1389eada6749c3d9ad8bacf8b0ec30c50e8bb2bd8d11ee9a820c33e65f62694

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
46KB

MD5
013960606c82ccc43d73c5aedd70a22d

SHA1
3f2ad8c72c620faa5f8262f457c41e0e236dbbf2

SHA256
9e838efdf8fbeaf79492556bacf914c854fa7bc4cf7ce22c2b0f969587a0601e

SHA512
4ab10d5d9a7ce6e14a6e2073d3b86d6c409bd7d54ea87601e06927ec74215d4a0f730c8ea7eaacd2003b7ba1167e0828df222f4220100354b5917eeefe7badac

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
6KB

MD5
ffa80ed4efd69eab5c28fcf4dbac0730

SHA1
377218aa7b172376d44aeea986579410f8fbbf34

SHA256
6ad2831a3a0457544ea388433a14a628a4ba4b6e4d4bda475476b3cca38a6334

SHA512
81dbedfa766e1f2ca96f28360f7f7c5a5cad40f695e07b8ad36e3f037659adff5162452cc1c193656b976de3fdcf2415b673c696783c71608e0dd14f2a1c1235

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
34KB

MD5
14fbbfe4fa7b9ec9d66063be5eec693b

SHA1
7399d85bcca9824ed9176fa1a6f4e582e40dede9

SHA256
79e20b10e3883f4af1876c1c0b6fa9aa07ace8a2487a2c36f4c4cd23985cefb5

SHA512
02fc2643407599cce737fa13b70fef5cc80e5e6752cf2a38faf40ccc3970b47e971a952164d3001d80c3101f5ceb47849b3d3715da36c6e5acb7f37c4cba6425

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe

Filesize
72KB

MD5
9cb72d14bbef4d1144bd920199458a5b

SHA1
157b4fb5b93a066b328df9296a315b148eb2e1cc

SHA256
f043147be2cec0f5c104359278edda4922bf113f138dd5c414ab01f01032f434

SHA512
fb6fede80522b1dc4daf9591708e84ad8d10945b952e960f53d654c70e508548a21deefe51fca998fa7174f204acf862a6d855b9721c21a7ea94065321ecdd2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
22KB

MD5
c3e2499597ce656caee0c31e4457803b

SHA1
f0baa3b0ae1565c8e1dff8eb280ed7d51f56935f

SHA256
157861b9b2191fe59d5e56fb555452933c7b400970772f558926014ccd16f7b2

SHA512
e3cd5be236fa13d71f62f18f1fe332edfd1ec19ea53531cd39525cb4b765d402f7003e65089a0309c8e1cfc7d3efb91d7724cd8e9eaf4a3605dfc89fa91f82bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
62KB

MD5
e4708cec0b85956a4ee74a17716366ab

SHA1
cc9fcd3b9e44d7cc99478a9dd09f67ac367911af

SHA256
b3c26d1ba4d05b9a0154b1104ecf3546d8223a725fe8f697d2c18cb21a33597d

SHA512
27dbbca5fd9284605086ac23c0b269cb936c74bb190cbf82e9c17eb76075db92307f3c60cc9b9e72d43ff4300ca063d9a2b0e8304e0b02999fa7ed45783dafad

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
a13c24a4f7130533fd38a6e3c820532a

SHA1
40e2b7517bb48dbd7c2b8390e5a156bd8eba875a

SHA256
87ee198a83ce7407b95909ff43611f1836b03369e1ef5a21e35ed23230581d26

SHA512
c390c857289bd00d1fc914636db0463fecc56aea1ac62b660c855409d30f8a426f0b87c92af501a0bbbc40c1ffe25f5d7c594f9af00dcaa7d4d74b1cff141a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\backup.exe

Filesize
1KB

MD5
e63a7c029300ad9025a6af766763f65c

SHA1
f9c0f5ac4786af176b0f7d9fe6556a9d4226159a

SHA256
3604434e4961435adc19ab5a701472e4f7f8e8b4eabee26e128d795310b408b6

SHA512
2510bfee2e4d2a7e6641512b3bd4c6f7feb8ad9e94649ac9de85fae612f8cd43cfc57b620c9154802b105af356db9d07894ed122d745ebeb9d08f2339b9eb930

Download Submit
C:\backup.exe

Filesize
72KB

MD5
713ed50b7e8d2bfe725c61fa8cecaaac

SHA1
ea3d6c855efc586fa341db7c3b124d9cb2f0a91b

SHA256
20ee81f5071727e4fef8a7107720e4bd5564211d1afadb8e7b65241985d63a26

SHA512
27fbf3bf0c9e61250eeaf6e848a4a008c58a4e4d59b0c0c392726c7f58f5c846d733c0350c73eb360da34704182bfe63dc84873b0f79e8c20e0d8b479562d159

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
e2fa6b6d5f74e07871f62beffd4029da

SHA1
dfc66b71b8261f9e0f4e42173f4722f382770258

SHA256
f940ad976d2d48fb0813fa0f1461a371513193b72b2f69ee670d2ebd88122700

SHA512
03dee4c255250b591120f527017ab80999347cc4b867d7ff6c3d00b5f6d683406128dc6f4415f73d090be0f11e5ccfbc36416d814315e3e5bbadcb1cbd95c7e3

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
29KB

MD5
08cb30f2f5b06ca752b6c39946b447e0

SHA1
d0e7c679b70012020fea50c684990ff43b13fe04

SHA256
0b55b0f3b45d49945465dd9bec7bb8de4c6eadf550f821f93d657f4c0746171b

SHA512
0cd0271366956f04e7de25edb6af8d4b501ca5a24246cf86d0d2cf8fc7b90644a36489c7fba8508c233269f212379beac92011a27482ccd37dd306a4a16e9d44

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
21KB

MD5
3a905cbb9efdd2b0cff2ba28a1bffa96

SHA1
c9d3ee384604a2fca943b58762e1052e342d24dc

SHA256
3711433bf346af239f212696238a4e1cd0251aaeef2f468871ab4cd30a061256

SHA512
25a40e7defaa0782acb6df5cf90620df70d72a2cd627f441284959b5a49086263a4744801f4a06ad55f8b8f077d8c4e3f8e950433ea63187c16d0074eb906793

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
28KB

MD5
4e13a0faf8a1628e11ea0f39fd4e3159

SHA1
15e49b0c954573946a171cc3139462831d5d927d

SHA256
02ecad46abce9db566aac104e7efc7c095bf47afce594130bcf76c5dcf952e0b

SHA512
87049089119c3175aeb7c841630d363752662af9ec82a5c53b340cfbb56755360d0c9c336020d0fe782859697abee688ec486ff9350a445fa1af356ba8a2a1ea

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

Filesize
32KB

MD5
a4d657815d3608beb3e41a9d4802fd32

SHA1
50af2ea9014cf33dc683c6375f9aaf3f0dfa9387

SHA256
7633d41144ba28fb97a3a0e08350f484f1684912cde4bbbe192c87d04de64e51

SHA512
1dd570c561609f46162489c78548c006b417234541bde456ce88fc43bf1389dafafa52249bb112f862872a6c7c5c806b1bc5c02a95d781d8b070d3f1fcbb115f

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe

Filesize
5KB

MD5
afcb48bd789e7b832e96abd776a93e6f

SHA1
1041e2cc1f3c4b64a929d88f6c3b0e55463f7d14

SHA256
4c0d102019e183af45ef00d3feac9d7dc0167ddebde98a48b7d5299a8c9c69b5

SHA512
a298a7b45dfe6bbf908411ff45ba02434ea241a7f95699fc148287dc6790ea0ad55237f71ee08494e53fd8f28e16cd746dff1e7f751641c8fbb43f7dac8161c8

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
48KB

MD5
0d5db202df7161d3cf5b09e96bc87474

SHA1
45feb99730dc1bd774fd3b15b08e42e90e983825

SHA256
cdd4b80b713a327d918f700fc9e753c709a6f55a237727a9507461830046e12f

SHA512
6b56d22d77f7585124e9a3975dd4a78799483fa2e18d0d7b6cade3b52b5cc2104217f6c853d2b7c26d775df90afadbb0455962f0503e6a6763b907f8cc93a57f

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
40KB

MD5
5f12d279a1edfde5d56a856f95703561

SHA1
612b632de8d508c537a04747aacc9d3de521a67c

SHA256
bb5a9339bfb567ccfa0f44ff6b5d3fe3b024408265e290c9ac8a5836ebcfe589

SHA512
ecf1484d976450bd4c5c216e5489598f3adc96e31d8998b0c0e8c0b36f6de221508d985344b0d85f0d28be7354cc680f3a1353ee83f0617ae9668ff0461e8dad

Download Submit
memory/1968-122-0x00000000028D0000-0x00000000028D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads