6c41b238f0fbb9ba2483138ae85cca1aa28d09dc1dbb0b886f59bb582a5116ba

Analysis

max time kernel
0s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078f7b90ee42411ede50da5e66204ca7.exe
Size

72KB
MD5

078f7b90ee42411ede50da5e66204ca7
SHA1

31282d1d28f15e8a153b9ac4334d0009bb5c8dcd
SHA256

6c41b238f0fbb9ba2483138ae85cca1aa28d09dc1dbb0b886f59bb582a5116ba
SHA512

2ab67cd0a6cf6c260fd83f1706861e13b4480198a80f31007e357c1b3ce2dbf161f3d0c4055fa21f0d66b174f5fc927db472ae102179ff2b4c677c927f8d1d98
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2h:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP1

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	078f7b90ee42411ede50da5e66204ca7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	078f7b90ee42411ede50da5e66204ca7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	078f7b90ee42411ede50da5e66204ca7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 3 IoCs

pid	Process
1544	backup.exe
2264	backup.exe
2764	backup.exe

Loads dropped DLL 7 IoCs

pid	Process
2140	078f7b90ee42411ede50da5e66204ca7.exe
2140	078f7b90ee42411ede50da5e66204ca7.exe
2140	078f7b90ee42411ede50da5e66204ca7.exe
2140	078f7b90ee42411ede50da5e66204ca7.exe
2140	078f7b90ee42411ede50da5e66204ca7.exe
2140	078f7b90ee42411ede50da5e66204ca7.exe
2140	078f7b90ee42411ede50da5e66204ca7.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2140	078f7b90ee42411ede50da5e66204ca7.exe
1544	backup.exe
2264	backup.exe
2764	backup.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1544	2140	078f7b90ee42411ede50da5e66204ca7.exe	950
PID 2140 wrote to memory of 1544	2140	078f7b90ee42411ede50da5e66204ca7.exe	950
PID 2140 wrote to memory of 1544	2140	078f7b90ee42411ede50da5e66204ca7.exe	950
PID 2140 wrote to memory of 1544	2140	078f7b90ee42411ede50da5e66204ca7.exe	950
PID 2140 wrote to memory of 2264	2140	078f7b90ee42411ede50da5e66204ca7.exe	947
PID 2140 wrote to memory of 2264	2140	078f7b90ee42411ede50da5e66204ca7.exe	947
PID 2140 wrote to memory of 2264	2140	078f7b90ee42411ede50da5e66204ca7.exe	947
PID 2140 wrote to memory of 2264	2140	078f7b90ee42411ede50da5e66204ca7.exe	947
PID 2140 wrote to memory of 2764	2140	078f7b90ee42411ede50da5e66204ca7.exe	946
PID 2140 wrote to memory of 2764	2140	078f7b90ee42411ede50da5e66204ca7.exe	946
PID 2140 wrote to memory of 2764	2140	078f7b90ee42411ede50da5e66204ca7.exe	946
PID 2140 wrote to memory of 2764	2140	078f7b90ee42411ede50da5e66204ca7.exe	946

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	078f7b90ee42411ede50da5e66204ca7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	078f7b90ee42411ede50da5e66204ca7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	078f7b90ee42411ede50da5e66204ca7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	078f7b90ee42411ede50da5e66204ca7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
1⤵
PID:2168

C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\
1⤵
PID:2792

C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\
1⤵
PID:2132
- C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
  2⤵
  PID:2260

C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
1⤵
PID:580

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
1⤵
PID:1076

C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
1⤵
PID:1792
- C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
  2⤵
  PID:2836
- C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
  2⤵
  PID:1396

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:1708
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
  2⤵
  PID:2344
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
  2⤵
  PID:1540
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\
  2⤵
  PID:2672
- - C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
    3⤵
    PID:844

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
1⤵
PID:3020

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
1⤵
PID:2776

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
1⤵
PID:2656

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
1⤵
PID:2252
- C:\Program Files\Google\Chrome\Application\backup.exe
  "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
  2⤵
  PID:2716
- C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
  2⤵
  PID:320

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
1⤵
PID:2968

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
1⤵
PID:2556

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:2940

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
1⤵
PID:2904
- C:\Program Files\Java\jre7\bin\backup.exe
  "C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
  2⤵
  PID:1756
- - C:\Program Files\Java\jre7\bin\server\backup.exe
    "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
    3⤵
    PID:296
- - C:\Program Files\Java\jre7\bin\plugin2\backup.exe
    "C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
    3⤵
    PID:2716
- - C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
    "C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
    3⤵
    PID:1636
- - C:\Program Files\Common Files\System\Ole DB\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
    3⤵
    PID:896
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
      4⤵
      PID:2964
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
      4⤵
      PID:2860
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
      4⤵
      PID:2368
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
      4⤵
      PID:2640
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
      4⤵
      PID:2812
- - C:\Program Files\Common Files\System\msadc\System Restore.exe
    "C:\Program Files\Common Files\System\msadc\System Restore.exe" C:\Program Files\Common Files\System\msadc\
    3⤵
    PID:2768
- - C:\Program Files\Common Files\System\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
    3⤵
    PID:2284
- - C:\Program Files\Common Files\System\it-IT\backup.exe
    "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
    3⤵
    PID:2528
- - C:\Program Files\Common Files\System\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
    3⤵
    PID:2512
- - C:\Program Files\Common Files\System\es-ES\backup.exe
    "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
    3⤵
    PID:3000
- - C:\Program Files\Common Files\System\en-US\backup.exe
    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
    3⤵
    PID:2996
- - C:\Program Files\Common Files\System\de-DE\backup.exe
    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
    3⤵
    PID:2924

C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
1⤵
PID:2112
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
  2⤵
  PID:2992
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
  2⤵
  PID:1708
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
  2⤵
  PID:2224
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
  2⤵
  PID:1740
- - C:\Program Files\7-Zip\Lang\backup.exe
    "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
    3⤵
    PID:2972

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
1⤵
PID:580

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
1⤵
PID:676

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
1⤵
PID:2092
- C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
  2⤵
  PID:2104
- C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
  2⤵
  PID:1760
- C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
  2⤵
  PID:536

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
1⤵
PID:1820

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
1⤵
PID:2000

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:1500
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
  2⤵
  PID:3056

C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:2680

C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
1⤵
PID:1512

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:1980
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:1640
- C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
  2⤵
  PID:2856

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
1⤵
PID:2972
- C:\Program Files\MSBuild\Microsoft\backup.exe
  "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
  2⤵
  PID:1876
- - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
    "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
    3⤵
    PID:352

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
1⤵
PID:1660

C:\Program Files\Common Files\System\ado\backup.exe
"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
1⤵
PID:2116

C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
1⤵
PID:2556

C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
1⤵
PID:2232

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:296

C:\Program Files\DVD Maker\ja-JP\backup.exe
"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
1⤵
PID:1260

C:\Program Files\DVD Maker\Shared\backup.exe
"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
1⤵
PID:2868
- C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
  2⤵
  PID:784
- - C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\System Restore.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
    3⤵
    PID:2312
  - - C:\Program Files\Java\jre7\backup.exe
      "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
      4⤵
      PID:2904
  - - C:\Program Files\Java\jdk1.7.0_80\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
      4⤵
      PID:1700
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
    3⤵
    PID:2504
  - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
      4⤵
      PID:2524
    - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
        5⤵
        
        PID:2424
      - C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
        6⤵
        
        PID:2092
    - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
        5⤵
        
        PID:3056
    - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\
        5⤵
        
        PID:1992
- - C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
    3⤵
    PID:3056
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
    3⤵
    PID:356

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\update.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\update.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
1⤵
PID:1880
- C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
  2⤵
  PID:2992
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
    3⤵
    PID:320

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
1⤵
PID:1196

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:348

C:\Program Files\Internet Explorer\de-DE\backup.exe
"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:2244
- C:\Program Files\Java\jre7\lib\amd64\backup.exe
  "C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
  2⤵
  PID:1740
- C:\Program Files\Java\jre7\lib\deploy\backup.exe
  "C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\
  2⤵
  PID:1312
- C:\Program Files\Java\jre7\lib\images\backup.exe
  "C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
  2⤵
  PID:2712
- C:\Program Files\Java\jre7\lib\management\backup.exe
  "C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
  2⤵
  PID:1548
- C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
  2⤵
  PID:2448

C:\Program Files\Internet Explorer\es-ES\update.exe
"C:\Program Files\Internet Explorer\es-ES\update.exe" C:\Program Files\Internet Explorer\es-ES\
1⤵
PID:1244

C:\Program Files\Internet Explorer\it-IT\backup.exe
"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
1⤵
PID:1824

C:\Program Files\Internet Explorer\SIGNUP\update.exe
"C:\Program Files\Internet Explorer\SIGNUP\update.exe" C:\Program Files\Internet Explorer\SIGNUP\
1⤵
PID:1692
- C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
  2⤵
  PID:352
- C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\
  2⤵
  PID:2000
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
    3⤵
    PID:1596
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
    3⤵
    PID:2892
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\
    3⤵
    PID:2956
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\
    3⤵
    PID:2980
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
    3⤵
    PID:448
  - - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
      4⤵
      PID:872
  - - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\data.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
      4⤵
      PID:2116
    - - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
        5⤵
        
        PID:708
    - - C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        5⤵
        
        PID:1960
    - - C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        5⤵
        
        PID:620
    - - C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        5⤵
        
        PID:1628
      - C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\
        6⤵
        
        PID:2272
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\
        7⤵
        
        PID:2356
      - C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe
        
        "C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\
        6⤵
        
        PID:2632
      - C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe
        
        "C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\
        6⤵
        
        PID:2712
      - C:\Program Files (x86)\Microsoft Office\Office14\backup.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\
        6⤵
        
        PID:1584
    - - C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        5⤵
        
        PID:1564
    - - C:\Program Files\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
        5⤵
        
        PID:2484
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
    3⤵
    PID:2628
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
    3⤵
    PID:2728
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
    3⤵
    PID:2456
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
    3⤵
    PID:2908
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
    3⤵
    PID:1152
  - - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
      4⤵
      PID:2712
  - - C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
      4⤵
      PID:1316
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\
    3⤵
    PID:408
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\
    3⤵
    PID:536
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\
    3⤵
    PID:1636
  - - C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\
      4⤵
      PID:2068
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\update.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
    3⤵
    PID:2652
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
    3⤵
    PID:2932

C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
1⤵
PID:2308

C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
1⤵
PID:764
- C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
  2⤵
  PID:2464

C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
1⤵
PID:2800

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
1⤵
PID:2736

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
1⤵
PID:2948
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
  2⤵
  PID:2752

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
1⤵
PID:768
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
  2⤵
  PID:2084
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
  2⤵
  PID:3028
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
  2⤵
  PID:888
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
    3⤵
    PID:1640
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
    3⤵
    PID:832
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
    3⤵
    PID:2192
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
    3⤵
    PID:2592
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
    3⤵
    PID:2260
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
  2⤵
  PID:1764
- - C:\PerfLogs\Admin\backup.exe
    C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
    3⤵
    PID:1668

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\update.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
1⤵
PID:2096

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
1⤵
PID:1096

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
1⤵
PID:1876

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
1⤵
PID:2308
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
  2⤵
  PID:2924
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
    3⤵
    PID:2788
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
    3⤵
    PID:2660
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
    3⤵
    PID:3040
- C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
  2⤵
  PID:2492

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
1⤵
PID:2836
- C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
  2⤵
  PID:2832
- C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
  2⤵
  PID:2568
- C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
  2⤵
  PID:2788
- C:\Program Files\Microsoft Games\Solitaire\it-IT\update.exe
  "C:\Program Files\Microsoft Games\Solitaire\it-IT\update.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\
  2⤵
  PID:708

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
1⤵
PID:2672

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
1⤵
PID:2928

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\
1⤵
PID:2044

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:1316

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
1⤵
PID:1260

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
1⤵
PID:2596
- C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
  2⤵
  PID:1312
- - C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
    3⤵
    PID:1364

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:1164

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
1⤵
PID:1408

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
1⤵
PID:1948

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
1⤵
PID:2376

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
1⤵
PID:3020
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
  2⤵
  PID:1992
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
  2⤵
  PID:2936

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
1⤵
PID:1976
- C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
  2⤵
  PID:2788

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
1⤵
PID:2612

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
1⤵
PID:2400
- C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\modules\
  2⤵
  PID:1700

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
1⤵
PID:2628

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
1⤵
PID:2876

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
1⤵
PID:1468

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
1⤵
PID:2712

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
1⤵
PID:1092

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
1⤵
PID:1936

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
1⤵
PID:2284

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:2780

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
1⤵
PID:2928

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\
1⤵
PID:2908

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
1⤵
PID:2604
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
  2⤵
  PID:2296

C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
1⤵
PID:1808
- C:\Program Files\Windows Journal\en-US\backup.exe
  "C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
  2⤵
  PID:2764
- C:\Program Files\Windows Journal\de-DE\backup.exe
  "C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\
  2⤵
  PID:3000
- C:\Program Files\Windows Journal\fr-FR\backup.exe
  "C:\Program Files\Windows Journal\fr-FR\backup.exe" C:\Program Files\Windows Journal\fr-FR\
  2⤵
  PID:2964
- C:\Program Files\Windows Journal\it-IT\backup.exe
  "C:\Program Files\Windows Journal\it-IT\backup.exe" C:\Program Files\Windows Journal\it-IT\
  2⤵
  PID:2752
- C:\Program Files\Windows Journal\Templates\backup.exe
  "C:\Program Files\Windows Journal\Templates\backup.exe" C:\Program Files\Windows Journal\Templates\
  2⤵
  PID:2188
- C:\Program Files\Windows Journal\ja-JP\backup.exe
  "C:\Program Files\Windows Journal\ja-JP\backup.exe" C:\Program Files\Windows Journal\ja-JP\
  2⤵
  PID:312
- C:\Program Files\Windows Journal\es-ES\backup.exe
  "C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
  2⤵
  PID:2696
- - C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
    3⤵
    PID:2640
  - - C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
      4⤵
      PID:2256
    - - C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
        5⤵
        
        PID:2200
  - - C:\Program Files\VideoLAN\VLC\lua\playlist\data.exe
      "C:\Program Files\VideoLAN\VLC\lua\playlist\data.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
      4⤵
      PID:1588

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
1⤵
PID:1948

C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
1⤵
PID:2932

C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
1⤵
PID:2776

C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
1⤵
PID:2236

C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
1⤵
PID:1992

C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
"C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
1⤵
PID:3020

C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
1⤵
PID:2928
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
  2⤵
  PID:2592

C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
1⤵
PID:1632

C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\
1⤵
PID:1528

C:\Program Files\Microsoft Games\FreeCell\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
1⤵
PID:628
- C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
  2⤵
  PID:648

C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
1⤵
PID:1592

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
1⤵
PID:2108

C:\Program Files\Microsoft Games\Hearts\ja-JP\data.exe
"C:\Program Files\Microsoft Games\Hearts\ja-JP\data.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
1⤵
PID:1952

C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
1⤵
PID:688

C:\Program Files\Microsoft Games\Minesweeper\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\
1⤵
PID:1720

C:\Program Files\Microsoft Games\More Games\backup.exe
"C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\
1⤵
PID:356

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
1⤵
PID:2664
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
  2⤵
  PID:1768
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\
  2⤵
  PID:2648
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\
  2⤵
  PID:2880
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\
  2⤵
  PID:1984
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\
  2⤵
  PID:896
- - C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
    3⤵
    PID:2332
- - C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
    3⤵
    PID:2052
- - C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
    3⤵
    PID:2652
- - C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
    3⤵
    PID:2268
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
  2⤵
  PID:2908
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
    3⤵
    PID:1632
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
      4⤵
      PID:2664
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
      4⤵
      PID:1336
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
      4⤵
      PID:2760
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
      4⤵
      PID:3064
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
      4⤵
      PID:2944

C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\
1⤵
PID:2692

C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
1⤵
PID:352
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
  2⤵
  PID:1688

C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
1⤵
PID:2976

C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
1⤵
PID:568

C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
1⤵
PID:2996

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
1⤵
PID:2920

C:\Program Files\Microsoft Office\Office14\1033\backup.exe
"C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
1⤵
PID:2044

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:2604
- C:\Program Files\Mozilla Firefox\browser\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
  2⤵
  PID:1336
- - C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
    3⤵
    PID:1768
- - C:\Program Files\Mozilla Firefox\browser\features\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
    3⤵
    PID:1700
  - - C:\Program Files\Java\jdk1.7.0_80\lib\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
      4⤵
      PID:1200
  - - C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
      4⤵
      PID:2504
  - - C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
      4⤵
      PID:2000
  - - C:\Program Files\Java\jdk1.7.0_80\db\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\db\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\db\
      4⤵
      PID:1792
- - C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
    3⤵
    PID:2864
- - C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
    3⤵
    PID:1984
- - C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
    3⤵
    PID:2052
- C:\Program Files\Mozilla Firefox\fonts\System Restore.exe
  "C:\Program Files\Mozilla Firefox\fonts\System Restore.exe" C:\Program Files\Mozilla Firefox\fonts\
  2⤵
  PID:2080
- - C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
    3⤵
    PID:648
- C:\Program Files\Mozilla Firefox\uninstall\backup.exe
  "C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
  2⤵
  PID:1200
- C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
  2⤵
  PID:2440
- C:\Program Files\Mozilla Firefox\defaults\backup.exe
  "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
  2⤵
  PID:1676
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
    3⤵
    PID:2716
  - - C:\Program Files\Google\Chrome\Application\SetupMetrics\System Restore.exe
      "C:\Program Files\Google\Chrome\Application\SetupMetrics\System Restore.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
      4⤵
      PID:296
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
      4⤵
      PID:888

C:\Program Files\Reference Assemblies\Microsoft\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
1⤵
PID:604

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
1⤵
PID:2016
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
  2⤵
  PID:1760
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System Restore.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
  2⤵
  PID:1684
- C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
  2⤵
  PID:1976

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
1⤵
PID:2660

C:\Program Files\VideoLAN\VLC\backup.exe
"C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
1⤵
PID:2868
- C:\Program Files\VideoLAN\VLC\locale\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
  2⤵
  PID:2904
- - C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
    3⤵
    PID:1716
  - - C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
      4⤵
      PID:2880
- - C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
    3⤵
    PID:1312
- - C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
    3⤵
    PID:2128
  - - C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
      4⤵
      PID:1380
- - C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\
    3⤵
    PID:600
  - - C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
      4⤵
      PID:2488
    - - C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\
        5⤵
        
        PID:1936
- - C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
    3⤵
    PID:2740
- - C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\
    3⤵
    PID:340
- - C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
    3⤵
    PID:1656
  - - C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\
      4⤵
      PID:2956
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
        5⤵
        
        PID:2752
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
        5⤵
        
        PID:2180
- - C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
    3⤵
    PID:1928
  - - C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
      4⤵
      PID:2792
  - - C:\Program Files\Common Files\System\backup.exe
      "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
      4⤵
      PID:1756
  - - C:\Program Files\Common Files\SpeechEngines\backup.exe
      "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
      4⤵
      PID:1800
  - - C:\Program Files\Common Files\Services\backup.exe
      "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
      4⤵
      PID:540
  - - C:\Program Files\Common Files\Microsoft Shared\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
      4⤵
      PID:484
- - C:\Program Files\VideoLAN\VLC\locale\en_GB\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\en_GB\update.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
    3⤵
    PID:1652
- - C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
    3⤵
    PID:1128
  - - C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
      4⤵
      PID:2676
- - C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
    3⤵
    PID:2236
  - - C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
      4⤵
      PID:1648
- - C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\
    3⤵
    PID:2368
- - C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
    3⤵
    PID:2756
  - - C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
      4⤵
      PID:832
- - C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
    3⤵
    PID:1980
- - C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
    3⤵
    PID:572
- - C:\Program Files\VideoLAN\VLC\locale\he\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\
    3⤵
    PID:1128
  - - C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\System Restore.exe
      "C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
      4⤵
      PID:600
    - - C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
        5⤵
        
        PID:3032
- - C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
    3⤵
    PID:1644
  - - C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
      4⤵
      PID:568
- - C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\
    3⤵
    PID:2256
- - C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\
    3⤵
    PID:2632
- - C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
    3⤵
    PID:2676
  - - C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
      4⤵
      PID:1628
- - C:\Program Files\VideoLAN\VLC\locale\it\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\
    3⤵
    PID:584
  - - C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
      4⤵
      PID:664
- - C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\
    3⤵
    PID:604
  - - C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
      4⤵
      PID:2944
- - C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
    3⤵
    PID:560
- - C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
    3⤵
    PID:844
  - - C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
      4⤵
      PID:1512
- - C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
    3⤵
    PID:2076
  - - C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
      4⤵
      PID:1528
- - C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
    3⤵
    PID:1200
  - - C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
      4⤵
      PID:1824
- - C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
    3⤵
    PID:1076
  - - C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\data.exe
      "C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
      4⤵
      PID:2504
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
        5⤵
        
        PID:992
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\System Restore.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
      4⤵
      PID:1956
    - - C:\Users\Admin\Searches\backup.exe
        
        C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
        5⤵
        
        PID:2532
    - - C:\Users\Admin\Videos\backup.exe
        
        C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
        5⤵
        
        PID:1796
- - C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\
    3⤵
    PID:1380
  - - C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
      4⤵
      PID:1408
    - - C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
        5⤵
        
        PID:1964
- - C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
    3⤵
    PID:2592
  - - C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
      4⤵
      PID:3016
- - C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
    3⤵
    PID:552
  - - C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
      4⤵
      PID:1528
- - C:\Program Files\VideoLAN\VLC\locale\ps\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\ps\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
    3⤵
    PID:1652
  - - C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\
      4⤵
      PID:1720
    - - C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
        5⤵
        
        PID:2892
    - - C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
        5⤵
        
        PID:2640
      - C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
        6⤵
        
        PID:1872
        
        C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
        7⤵
        
        PID:2836
        
        C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
        7⤵
        
        PID:628
        
        C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
        7⤵
        
        PID:3032
        
        C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
        7⤵
        
        PID:2300
        
        C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
        7⤵
        
        PID:2104
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
        7⤵
        
        PID:1492
        
        C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
        7⤵
        
        PID:268
        
        C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\System Restore.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
        7⤵
        
        PID:2600
        
        C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
        7⤵
        
        PID:2988
        
        C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
        7⤵
        
        PID:1676
        
        C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
        7⤵
        
        PID:2188
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
        7⤵
        
        PID:2468
        
        C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
        7⤵
        
        PID:1996
        
        C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
        7⤵
        
        PID:2592
        
        C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
        7⤵
        
        PID:2268
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
        7⤵
        
        PID:896
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
        7⤵
        
        PID:3060
        
        C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
        7⤵
        
        PID:1320
        
        C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
        7⤵
        
        PID:908
        
        C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
        7⤵
        
        PID:2460
        
        C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
        7⤵
        
        PID:752
        
        C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
        7⤵
        
        PID:1248
        
        C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
        7⤵
        
        PID:2308
        
        C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
        7⤵
        
        PID:408
    - - C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
        5⤵
        
        PID:2912
    - - C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
        5⤵
        
        PID:2524
    - - C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
        5⤵
        
        PID:2512
    - - C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
        5⤵
        
        PID:3000
- - C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\
    3⤵
    PID:1980
  - - C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
      4⤵
      PID:2072
- - C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
    3⤵
    PID:1840
  - - C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
      4⤵
      PID:2712
    - - C:\Program Files\Java\jre7\lib\images\cursors\data.exe
        
        "C:\Program Files\Java\jre7\lib\images\cursors\data.exe" C:\Program Files\Java\jre7\lib\images\cursors\
        5⤵
        
        PID:1268
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
        5⤵
        
        PID:856
- - C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\
    3⤵
    PID:484
  - - C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\
      4⤵
      PID:2380
  - - C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
      4⤵
      PID:2072
  - - C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
      4⤵
      PID:2068
  - - C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
      4⤵
      PID:1632
  - - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
      4⤵
      PID:356
  - - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
      4⤵
      PID:2732
  - - C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
      4⤵
      PID:1872
- - C:\Program Files\VideoLAN\VLC\locale\si\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\si\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\
    3⤵
    PID:2104
  - - C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
      4⤵
      PID:1596
    - - C:\Program Files\Internet Explorer\ja-JP\backup.exe
        
        "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
        5⤵
        
        PID:540
    - - C:\Program Files\Internet Explorer\images\backup.exe
        
        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
        5⤵
        
        PID:2596
    - - C:\Program Files\Internet Explorer\fr-FR\backup.exe
        
        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
        5⤵
        
        PID:1496
    - - C:\Program Files\Internet Explorer\en-US\System Restore.exe
        
        "C:\Program Files\Internet Explorer\en-US\System Restore.exe" C:\Program Files\Internet Explorer\en-US\
        5⤵
        
        PID:2224
- - C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
    3⤵
    PID:1684
  - - C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\
      4⤵
      PID:2568
  - - C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
      4⤵
      PID:2772
- - C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\
    3⤵
    PID:2696
  - - C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
      4⤵
      PID:2760
- - C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\
    3⤵
    PID:2004
  - - C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\
      4⤵
      PID:356
    - - C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
        5⤵
        
        PID:2044
- - C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\
    3⤵
    PID:1352
  - - C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
      4⤵
      PID:648
- - C:\Program Files\VideoLAN\VLC\locale\th\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\th\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\
    3⤵
    PID:2284
  - - C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\
      4⤵
      PID:2200
    - - C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\
        5⤵
        
        PID:2740
      - C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
        6⤵
        
        PID:2644
- - C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\
    3⤵
    PID:1816
  - - C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\
      4⤵
      PID:1300
  - - C:\Program Files\Microsoft Office\Office14\backup.exe
      "C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
      4⤵
      PID:2192
- - C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\
    3⤵
    PID:2244
  - - C:\Program Files\Java\jre7\lib\zi\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
      4⤵
      PID:2380
  - - C:\Program Files\Java\jre7\lib\security\backup.exe
      "C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
      4⤵
      PID:2016
  - - C:\Program Files\Java\jre7\lib\jfr\backup.exe
      "C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
      4⤵
      PID:448
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
        5⤵
        
        PID:1952
  - - C:\Program Files\Java\jre7\lib\fonts\backup.exe
      "C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\
      4⤵
      PID:1824
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
        5⤵
        
        PID:904
  - - C:\Program Files\Java\jre7\lib\ext\backup.exe
      "C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
      4⤵
      PID:1508
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
        5⤵
        
        PID:996
  - - C:\Program Files\Java\jre7\lib\cmm\backup.exe
      "C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
      4⤵
      PID:1436
  - - C:\Program Files\Java\jre7\lib\applet\backup.exe
      "C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
      4⤵
      PID:772
- - C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\
    3⤵
    PID:1796
  - - C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\System Restore.exe
      "C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\
      4⤵
      PID:2984
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
        5⤵
        
        PID:2300
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
        5⤵
        
        PID:1364
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
        5⤵
        
        PID:2588
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
        5⤵
        
        PID:268
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
        5⤵
        
        PID:1436
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\data.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
        5⤵
        
        PID:2072
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
        5⤵
        
        PID:1352
- - C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\
    3⤵
    PID:3064
- - C:\Program Files\VideoLAN\VLC\locale\uz\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\uz\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\
    3⤵
    PID:1144
- - C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\
    3⤵
    PID:904
- - C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
    3⤵
    PID:2668
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\
      4⤵
      PID:2972
    - - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
        5⤵
        
        PID:996
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
      4⤵
      PID:1200
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
        5⤵
        
        PID:2112
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\
      4⤵
      PID:2472
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\
      4⤵
      PID:1940
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
      4⤵
      PID:2080
- - C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\
    3⤵
    PID:1468
  - - C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\data.exe
      "C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\
      4⤵
      PID:1688
- - C:\Program Files\VideoLAN\VLC\locale\tet\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tet\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\
    3⤵
    PID:2564
- - C:\Program Files\VideoLAN\VLC\locale\te\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\te\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\
    3⤵
    PID:2224
  - - C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
      4⤵
      PID:664
- - C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\
    3⤵
    PID:2488
- - C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\
    3⤵
    PID:1096
  - - C:\Users\Public\backup.exe
      C:\Users\Public\backup.exe C:\Users\Public\
      4⤵
      PID:2348
- - C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
    3⤵
    PID:1692
- - C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
    3⤵
    PID:3012
- - C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
    3⤵
    PID:2248
- - C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
    3⤵
    PID:2696
- - C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
    3⤵
    PID:2380
  - - C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
      4⤵
      PID:1988
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
        5⤵
        
        PID:2784
  - - C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe" C:\Program Files\Java\jre7\lib\zi\Europe\
      4⤵
      PID:2820
  - - C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
      4⤵
      PID:304
  - - C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
      4⤵
      PID:2740
  - - C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
      4⤵
      PID:2196
  - - C:\Program Files\Java\jre7\lib\zi\America\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
      4⤵
      PID:1972
- - C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
    3⤵
    PID:1440
- - C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
    3⤵
    PID:1272
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
      4⤵
      PID:2940
- - C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\
    3⤵
    PID:664
- - C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
    3⤵
    PID:2636
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
      4⤵
      PID:2892
- - C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
    3⤵
    PID:2200
- - C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\
    3⤵
    PID:2696
- - C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\
    3⤵
    PID:1408
- - C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
    3⤵
    PID:1692
- - C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\
    3⤵
    PID:1260
  - - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
      4⤵
      PID:1048
- - C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\
    3⤵
    PID:356
- - C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\
    3⤵
    PID:1116
- - C:\Program Files\VideoLAN\VLC\locale\km\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\km\update.exe" C:\Program Files\VideoLAN\VLC\locale\km\
    3⤵
    PID:2616
- - C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
    3⤵
    PID:1500
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
      4⤵
      PID:2884
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
      4⤵
      PID:2196
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
      4⤵
      PID:2280
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
      4⤵
      PID:2524
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
      4⤵
      PID:2344
- - C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
    3⤵
    PID:764
- - C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
    3⤵
    PID:1508
- - C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\
    3⤵
    PID:1840
- - C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\
    3⤵
    PID:1636
- - C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\
    3⤵
    PID:2596
- - C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
    3⤵
    PID:1880
- - C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\
    3⤵
    PID:1684
- - C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
    3⤵
    PID:2564
- - C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
    3⤵
    PID:2308
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
      4⤵
      PID:1888
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
      4⤵
      PID:1256
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
      4⤵
      PID:708
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
      4⤵
      PID:1628
- - C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
    3⤵
    PID:536
- - C:\Program Files\VideoLAN\VLC\locale\es\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\
    3⤵
    PID:2424
- - C:\Program Files\VideoLAN\VLC\locale\el\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\
    3⤵
    PID:2560
- - C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
    3⤵
    PID:2816
- - C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
    3⤵
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe
      C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\
      4⤵
      PID:2736
- - C:\Program Files\VideoLAN\VLC\locale\co\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\
    3⤵
    PID:2900
  - - C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
      4⤵
      PID:1444
    - - C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\
        5⤵
        
        PID:2736
  - - C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\
      4⤵
      PID:2148
    - - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\
        5⤵
        
        PID:1180
    - - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\
        5⤵
        
        PID:2624
  - - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\
      4⤵
      PID:2876
- - C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\
    3⤵
    PID:2456
- - C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
    3⤵
    PID:2512
- - C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
    3⤵
    PID:1836
- - C:\Program Files\VideoLAN\VLC\locale\brx\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\brx\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
    3⤵
    PID:3060
- - C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
    3⤵
    PID:2224
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
      4⤵
      PID:3036
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
      4⤵
      PID:1328
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
      4⤵
      PID:448
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
      4⤵
      PID:1508
- - C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
    3⤵
    PID:2872
- - C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
    3⤵
    PID:2440
  - - C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
      "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
      4⤵
      PID:2472
- - C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
    3⤵
    PID:2080
- - C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
    3⤵
    PID:1440
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\data.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
      4⤵
      PID:296
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
      4⤵
      PID:2064
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
      4⤵
      PID:2188
- - C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
    3⤵
    PID:1152
- - C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
    3⤵
    PID:1996
- - C:\Program Files\VideoLAN\VLC\locale\af\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\af\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\af\
    3⤵
    PID:3064
  - - C:\Program Files\Microsoft Games\Solitaire\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
      4⤵
      PID:2836
  - - C:\Program Files\Microsoft Games\Purble Place\backup.exe
      "C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\
      4⤵
      PID:2172
  - - C:\Program Files\Microsoft Games\Multiplayer\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
      4⤵
      PID:2684
  - - C:\Program Files\Microsoft Games\Mahjong\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
      4⤵
      PID:1780
  - - C:\Program Files\Microsoft Games\Hearts\data.exe
      "C:\Program Files\Microsoft Games\Hearts\data.exe" C:\Program Files\Microsoft Games\Hearts\
      4⤵
      PID:600
  - - C:\Program Files\Microsoft Games\Chess\data.exe
      "C:\Program Files\Microsoft Games\Chess\data.exe" C:\Program Files\Microsoft Games\Chess\
      4⤵
      PID:1336
- - C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
    3⤵
    PID:2132
- - C:\Program Files\Java\jre7\lib\backup.exe
    "C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
    3⤵
    PID:2244
- C:\Program Files\VideoLAN\VLC\lua\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
  2⤵
  PID:2640
- - C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
    3⤵
    PID:2400
- - C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
    3⤵
    PID:2472
  - - C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\art\
      4⤵
      PID:908
  - - C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
      4⤵
      PID:2492
- C:\Program Files\VideoLAN\VLC\plugins\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\
  2⤵
  PID:2800
- - C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access\
    3⤵
    PID:2940
- - C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access_output\
    3⤵
    PID:1888
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
      4⤵
      PID:1440
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
      4⤵
      PID:1272
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
      4⤵
      PID:2956
- - C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
    3⤵
    PID:2896
- - C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\
    3⤵
    PID:2852
- C:\Program Files\VideoLAN\VLC\skins\backup.exe
  "C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
  2⤵
  PID:1772
- C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
  "C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
  2⤵
  PID:2448

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
1⤵
PID:1044

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
1⤵
PID:2500
- C:\Program Files (x86)\Common Files\Services\backup.exe
  "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
  2⤵
  PID:2988
- C:\Program Files (x86)\Common Files\microsoft shared\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\
  2⤵
  PID:2900
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
    3⤵
    PID:2344
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
      4⤵
      PID:2480
- C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
  "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
  2⤵
  PID:2772
- C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
  2⤵
  PID:2016
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
    3⤵
    PID:868
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
    3⤵
    PID:2480
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
    3⤵
    PID:584
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
    3⤵
    PID:2696
- C:\Program Files (x86)\Common Files\Adobe\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
  2⤵
  PID:2092

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
1⤵
PID:688

C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
1⤵
PID:1524

C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
1⤵
PID:2172

C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
1⤵
PID:2976

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\
1⤵
PID:2056

C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
1⤵
PID:1700

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:1820
- C:\Program Files (x86)\Adobe\data.exe
  "C:\Program Files (x86)\Adobe\data.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:1260
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:1260
- - C:\Program Files (x86)\Google\CrashReports\backup.exe
    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
    3⤵
    PID:992
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
      4⤵
      PID:2984
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
      4⤵
      PID:1996
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\
      4⤵
      PID:2620
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\update.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
      4⤵
      PID:2628
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
      4⤵
      PID:2040
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
      4⤵
      PID:1512
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
      4⤵
      PID:640
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
      4⤵
      PID:2820
- - C:\Program Files (x86)\Google\Temp\backup.exe
    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
    3⤵
    PID:2832
- - C:\Program Files (x86)\Google\Update\backup.exe
    "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
    3⤵
    PID:340
  - - C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
      4⤵
      PID:2848
    - - C:\Program Files\DVD Maker\it-IT\backup.exe
        
        "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
        5⤵
        
        PID:1244
    - - C:\Program Files\DVD Maker\fr-FR\backup.exe
        
        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
        5⤵
        
        PID:2224
    - - C:\Program Files\DVD Maker\es-ES\backup.exe
        
        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
        5⤵
        
        PID:2244
    - - C:\Program Files\DVD Maker\en-US\backup.exe
        
        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
        5⤵
        
        PID:1596
  - - C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Google\Update\Download\backup.exe
      "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
      4⤵
      PID:2960
    - - C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
        5⤵
        
        PID:1656
      - C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
        6⤵
        
        PID:1796
  - - C:\Program Files (x86)\Google\Update\Install\backup.exe
      "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
      4⤵
      PID:1496
    - - C:\Program Files (x86)\Google\Update\Install\{816A3475-9C83-4071-ADF3-DF13B538F008}\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{816A3475-9C83-4071-ADF3-DF13B538F008}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{816A3475-9C83-4071-ADF3-DF13B538F008}\
        5⤵
        
        PID:1968
  - - C:\Program Files (x86)\Google\Update\Offline\backup.exe
      "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
      4⤵
      PID:2164
- - C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
    3⤵
    PID:1676
  - - C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
      "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
      4⤵
      PID:2692
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:2124
- C:\Program Files (x86)\Common Files\update.exe
  "C:\Program Files (x86)\Common Files\update.exe" C:\Program Files (x86)\Common Files\
  2⤵
  PID:2500
- - C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
    "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
    3⤵
    PID:2788
  - - C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
      "C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
      4⤵
      PID:296
- - C:\Program Files (x86)\Common Files\System\backup.exe
    "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
    3⤵
    PID:2560
- C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft Office\backup.exe
  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
  2⤵
  PID:1628
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
    3⤵
    PID:620
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
  2⤵
  PID:1816
- - C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe
    "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\
    3⤵
    PID:1604
- C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
  "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft Visual Studio 8\update.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\update.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft.NET\backup.exe
  "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
  2⤵
  PID:2692
- C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
  2⤵
  PID:1760
- C:\Program Files (x86)\MSBuild\backup.exe
  "C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\
  2⤵
  PID:2720

C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\
1⤵
PID:1660

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
1⤵
PID:1948

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
1⤵
PID:3000

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
1⤵
PID:2280

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
1⤵
PID:1444
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
  2⤵
  PID:2296
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
    3⤵
    PID:1996
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
  2⤵
  PID:1716
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
  2⤵
  PID:1180
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
  2⤵
  PID:1624

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
1⤵
PID:3052

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
1⤵
PID:2772

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
1⤵
PID:340
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
  2⤵
  PID:1972
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
    3⤵
    PID:2248
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
    3⤵
    PID:2784
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
    3⤵
    PID:2780
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
    3⤵
    PID:2636
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
    3⤵
    PID:2896
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
  2⤵
  PID:2888
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
    3⤵
    PID:3020
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
      4⤵
      PID:844

C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
1⤵
PID:2532

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\System Restore.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
1⤵
PID:2448

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
1⤵
PID:356
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
  2⤵
  PID:2920
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
    3⤵
    PID:2952
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\update.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
    3⤵
    PID:1624
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
      4⤵
      PID:552
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\update.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
      4⤵
      PID:2400
- - C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
    3⤵
    PID:2076
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
      4⤵
      PID:2908
- - C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
    3⤵
    PID:2968
- - C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\
    3⤵
    PID:2756
- - C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\update.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\update.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
    3⤵
    PID:2816
- - C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\System Restore.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\System Restore.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
    3⤵
    PID:2088
- - C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
    3⤵
    PID:2936

C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\
1⤵
PID:996

C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
1⤵
PID:408

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
1⤵
PID:1872
- C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
  2⤵
  PID:992

C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
1⤵
PID:2168

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
1⤵
PID:2556
- C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
  2⤵
  PID:348

C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
1⤵
PID:2052

C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
1⤵
PID:1768

C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\
1⤵
PID:2692

C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
1⤵
PID:2620
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\
  2⤵
  PID:2080
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
  2⤵
  PID:2588
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
  2⤵
  PID:2504
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
  2⤵
  PID:1520
- C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
  2⤵
  PID:2256
- C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
  2⤵
  PID:2376
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
    3⤵
    PID:304
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
    3⤵
    PID:2740
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
  2⤵
  PID:2024
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
  2⤵
  PID:664
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
  2⤵
  PID:1808
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
  2⤵
  PID:2972
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\
  2⤵
  PID:1828

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
1⤵
PID:2172
- C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\
  2⤵
  PID:2000
- C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\
  2⤵
  PID:2164
- C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
  2⤵
  PID:1848
- C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
  2⤵
  PID:1960

C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
1⤵
PID:1992
- C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\
  2⤵
  PID:2976
- C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
  2⤵
  PID:1816
- C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
  2⤵
  PID:312
- C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\
  2⤵
  PID:1152
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\update.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
    3⤵
    PID:1992
  - - C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\update.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\
      4⤵
      PID:2180
  - - C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
      4⤵
      PID:620
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
      4⤵
      PID:1988
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
    3⤵
    PID:1996
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
      4⤵
      PID:2468
  - - C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
      4⤵
      PID:2052
- C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
  2⤵
  PID:3024
- C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\
  2⤵
  PID:1888

C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
1⤵
PID:784

C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
1⤵
PID:904
- C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
  2⤵
  PID:2164

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
1⤵
PID:448
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
  2⤵
  PID:2104
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
  2⤵
  PID:2800

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\
1⤵
PID:604
- C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
  2⤵
  PID:592

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
1⤵
PID:2968

C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
1⤵
PID:2888

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
1⤵
PID:2180
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\
  2⤵
  PID:1716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
    3⤵
    PID:2092
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
  2⤵
  PID:1352
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
  2⤵
  PID:936
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\
  2⤵
  PID:1092
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
  2⤵
  PID:2164
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
  2⤵
  PID:1960
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
  2⤵
  PID:2932
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
  2⤵
  PID:1780
- - C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
    3⤵
    PID:2000
  - - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
      4⤵
      PID:1688
  - - C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
      4⤵
      PID:1932
- - C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
    3⤵
    PID:568
- - C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
    3⤵
    PID:2164
- - C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
    3⤵
    PID:1848
- - C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
    3⤵
    PID:2492
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
  2⤵
  PID:2464
- - C:\Program Files\Windows Defender\de-DE\backup.exe
    "C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
    3⤵
    PID:2368
  - - C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
      4⤵
      PID:2964
- - C:\Program Files\Windows Defender\en-US\backup.exe
    "C:\Program Files\Windows Defender\en-US\backup.exe" C:\Program Files\Windows Defender\en-US\
    3⤵
    PID:2952
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
  2⤵
  PID:640
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
  2⤵
  PID:1500
- - C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
    3⤵
    PID:2808
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\
  2⤵
  PID:708
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\
  2⤵
  PID:1828
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
  2⤵
  PID:628
- - C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
    3⤵
    PID:536
- - C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
    3⤵
    PID:1940
- - C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
    3⤵
    PID:1772
- - C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
    3⤵
    PID:2692
  - - C:\Program Files\Google\Chrome\backup.exe
      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
      4⤵
      PID:2252
- - C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
    3⤵
    PID:1640
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
      4⤵
      PID:2336
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\
  2⤵
  PID:1768
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
  2⤵
  PID:1116
- - C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
    3⤵
    PID:312
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\
  2⤵
  PID:400

C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2964

C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\
1⤵
PID:1540
- C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
  2⤵
  PID:2968

C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\
1⤵
PID:2752

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
1⤵
PID:2888
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
  2⤵
  PID:2556
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
  2⤵
  PID:2056
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
    3⤵
    PID:2860

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\
1⤵
PID:2532

C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
1⤵
PID:3040
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
  2⤵
  PID:2068

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
1⤵
PID:1152
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\
  2⤵
  PID:2584
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\
  2⤵
  PID:560
- - C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
    3⤵
    PID:1268
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
  2⤵
  PID:1932

C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\
1⤵
PID:3060

C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
1⤵
PID:2040
- C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
  2⤵
  PID:1044
- - C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
    3⤵
    PID:2652
  - - C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\
      4⤵
      PID:2068
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
    3⤵
    PID:1664
- C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
  2⤵
  PID:2484
- C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\js\
  2⤵
  PID:2916
- C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\images\
  2⤵
  PID:3036
- C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
  2⤵
  PID:1740

C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
1⤵
PID:784
- C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
  2⤵
  PID:2784
- C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
  2⤵
  PID:2644
- C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
  2⤵
  PID:992
- C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
  2⤵
  PID:1992
- C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
  2⤵
  PID:2424
- C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
  2⤵
  PID:2524
- C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
  2⤵
  PID:764
- C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
  2⤵
  PID:1932
- C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
  2⤵
  PID:2000
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
    3⤵
    PID:1528
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
    3⤵
    PID:1440
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\
    3⤵
    PID:1524
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
    3⤵
    PID:2948
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
    3⤵
    PID:2044
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
    3⤵
    PID:2152
- C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
  2⤵
  PID:2836
- C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
  2⤵
  PID:1396
- C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
  2⤵
  PID:1792
- C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
  2⤵
  PID:2308
- C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
  2⤵
  PID:1700
- C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\System Restore.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
  2⤵
  PID:856
- C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
  2⤵
  PID:2712

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2464
- C:\Program Files\Windows Defender\ja-JP\backup.exe
  "C:\Program Files\Windows Defender\ja-JP\backup.exe" C:\Program Files\Windows Defender\ja-JP\
  2⤵
  PID:540
- C:\Program Files\Windows Defender\it-IT\backup.exe
  "C:\Program Files\Windows Defender\it-IT\backup.exe" C:\Program Files\Windows Defender\it-IT\
  2⤵
  PID:1980
- - C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
    3⤵
    PID:2880
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\data.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
    3⤵
    PID:1772
  - - C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
      "C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
      4⤵
      PID:2992
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
    3⤵
    PID:1652
  - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe
      "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\
      4⤵
      PID:3064
    - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\
        5⤵
        
        PID:2496
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
    3⤵
    PID:1300
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
    3⤵
    PID:1196
- C:\Program Files\Windows Defender\fr-FR\update.exe
  "C:\Program Files\Windows Defender\fr-FR\update.exe" C:\Program Files\Windows Defender\fr-FR\
  2⤵
  PID:2296
- C:\Program Files\Windows Defender\es-ES\backup.exe
  "C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
  2⤵
  PID:2056

C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\
1⤵
PID:996

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:1096
- C:\Users\Admin\backup.exe
  C:\Users\Admin\backup.exe C:\Users\Admin\
  2⤵
  PID:1956
- - C:\Users\Admin\Desktop\data.exe
    C:\Users\Admin\Desktop\data.exe C:\Users\Admin\Desktop\
    3⤵
    PID:2592
- - C:\Users\Admin\Downloads\backup.exe
    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
    3⤵
    PID:2448
- - C:\Users\Admin\Favorites\backup.exe
    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
    3⤵
    PID:2980
- - C:\Users\Admin\Documents\backup.exe
    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
    3⤵
    PID:2976
- - C:\Users\Admin\Contacts\backup.exe
    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
    3⤵
    PID:832
- - C:\Users\Admin\Links\backup.exe
    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
    3⤵
    PID:1352
- - C:\Users\Admin\Music\backup.exe
    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
    3⤵
    PID:1328
- - C:\Users\Admin\Pictures\backup.exe
    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
    3⤵
    PID:968
- - C:\Users\Admin\Saved Games\data.exe
    "C:\Users\Admin\Saved Games\data.exe" C:\Users\Admin\Saved Games\
    3⤵
    PID:2912
- C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\
  2⤵
  PID:1180
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
    3⤵
    PID:2588

C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\
1⤵
PID:2736

C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
1⤵
PID:2052

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:1808

C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\
1⤵
PID:868

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
1⤵
PID:2000
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
  2⤵
  PID:1292
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
  2⤵
  PID:2328
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
  2⤵
  PID:2796
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\
  2⤵
  PID:2644

C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
1⤵
PID:716

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
1⤵
PID:1944

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
1⤵
PID:572
- C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
  2⤵
  PID:1436

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
1⤵
PID:1800
- C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
  2⤵
  PID:1588

C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\
1⤵
PID:2584

C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
1⤵
PID:2072

C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
1⤵
PID:1796

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\
1⤵
PID:1948
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
  2⤵
  PID:348
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\
  2⤵
  PID:1660
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\
  2⤵
  PID:1380
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
  2⤵
  PID:568
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\
  2⤵
  PID:2300
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\
  2⤵
  PID:628
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\
  2⤵
  PID:1836

C:\Program Files\Windows Mail\backup.exe
"C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\
1⤵
PID:2240
- C:\Program Files\Windows Mail\de-DE\backup.exe
  "C:\Program Files\Windows Mail\de-DE\backup.exe" C:\Program Files\Windows Mail\de-DE\
  2⤵
  PID:1952
- C:\Program Files\Windows Mail\en-US\backup.exe
  "C:\Program Files\Windows Mail\en-US\backup.exe" C:\Program Files\Windows Mail\en-US\
  2⤵
  PID:2212
- C:\Program Files\Windows Mail\es-ES\backup.exe
  "C:\Program Files\Windows Mail\es-ES\backup.exe" C:\Program Files\Windows Mail\es-ES\
  2⤵
  PID:448
- C:\Program Files\Windows Mail\fr-FR\backup.exe
  "C:\Program Files\Windows Mail\fr-FR\backup.exe" C:\Program Files\Windows Mail\fr-FR\
  2⤵
  PID:1980
- C:\Program Files\Windows Mail\it-IT\backup.exe
  "C:\Program Files\Windows Mail\it-IT\backup.exe" C:\Program Files\Windows Mail\it-IT\
  2⤵
  PID:1468
- C:\Program Files\Windows Mail\ja-JP\backup.exe
  "C:\Program Files\Windows Mail\ja-JP\backup.exe" C:\Program Files\Windows Mail\ja-JP\
  2⤵
  PID:968

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:3020
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\
  2⤵
  PID:2532

C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
1⤵
PID:2132

C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
1⤵
PID:2964

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
1⤵
PID:2252

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
1⤵
PID:1788

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
1⤵
PID:1304

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
1⤵
PID:2416

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
1⤵
PID:2328

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
1⤵
PID:1076

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
1⤵
PID:2836
- C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
  2⤵
  PID:1724
- C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\
  2⤵
  PID:2728

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
1⤵
PID:2636

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
1⤵
PID:2200

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
1⤵
PID:1968

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
1⤵
PID:2924
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
  2⤵
  PID:2976
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
  2⤵
  PID:2128
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
  2⤵
  PID:1824
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
  2⤵
  PID:1496
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
  2⤵
  PID:600
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:1676
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:1352
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
  2⤵
  PID:1116
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
  2⤵
  PID:1044
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\
  2⤵
  PID:2076
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
  2⤵
  PID:2960
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
  2⤵
  PID:2004
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
  2⤵
  PID:2456
- - C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
    3⤵
    PID:1960
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
  2⤵
  PID:1056
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
  2⤵
  PID:2284
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
  2⤵
  PID:2528
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
  2⤵
  PID:2512
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
  2⤵
  PID:3000
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
  2⤵
  PID:716

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
1⤵
PID:352
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
  2⤵
  PID:408

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
1⤵
PID:1148

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
1⤵
PID:2104

C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
1⤵
PID:356
- C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
  2⤵
  PID:400
- C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
  2⤵
  PID:348
- C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
  2⤵
  PID:1708
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
    3⤵
    PID:2732
  - - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
      4⤵
      PID:2800
    - - C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_output\
        5⤵
        
        PID:1548
    - - C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\codec\
        5⤵
        
        PID:584
    - - C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\control\
        5⤵
        
        PID:2892
    - - C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
        5⤵
        
        PID:1564
    - - C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d9\
        5⤵
        
        PID:1164
    - - C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\demux\
        5⤵
        
        PID:2660
- C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
  2⤵
  PID:2088
- C:\Program Files\Microsoft Games\More Games\en-US\backup.exe
  "C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\
  2⤵
  PID:2868
- C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
  2⤵
  PID:1540
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\
    3⤵
    PID:2784
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
    3⤵
    PID:2376
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
      4⤵
      PID:2256

C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\
1⤵
PID:2844

C:\Program Files\Windows Media Player\backup.exe
"C:\Program Files\Windows Media Player\backup.exe" C:\Program Files\Windows Media Player\
1⤵
PID:2448

C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
1⤵
PID:1200

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:2732
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
  2⤵
  PID:1944

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System Restore.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:1972
- C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
  2⤵
  PID:2256
- C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
  2⤵
  PID:1524

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:2292

C:\Program Files\MSBuild\backup.exe
"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
1⤵
PID:2972

C:\Program Files\Microsoft Office\backup.exe
"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
1⤵
PID:1816

C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
1⤵
PID:2484

C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\
1⤵
PID:2300

C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
1⤵
PID:1812

C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
1⤵
PID:904

C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
1⤵
PID:268

C:\Program Files\Microsoft Games\Multiplayer\Checkers\System Restore.exe
"C:\Program Files\Microsoft Games\Multiplayer\Checkers\System Restore.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\
1⤵
PID:2668

C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
1⤵
PID:1076

C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
"C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
1⤵
PID:352

C:\Program Files\Windows NT\backup.exe
"C:\Program Files\Windows NT\backup.exe" C:\Program Files\Windows NT\
1⤵
PID:1092
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
  2⤵
  PID:1964

C:\Program Files\Microsoft Games\backup.exe
"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
1⤵
PID:3064

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
1⤵
PID:1684

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\
1⤵
PID:1972

C:\Program Files\Windows Photo Viewer\System Restore.exe
"C:\Program Files\Windows Photo Viewer\System Restore.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:2024
- C:\Program Files\Windows Photo Viewer\de-DE\backup.exe
  "C:\Program Files\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files\Windows Photo Viewer\de-DE\
  2⤵
  PID:2412
- C:\Program Files\Windows Photo Viewer\en-US\backup.exe
  "C:\Program Files\Windows Photo Viewer\en-US\backup.exe" C:\Program Files\Windows Photo Viewer\en-US\
  2⤵
  PID:3056
- C:\Program Files\Windows Photo Viewer\es-ES\backup.exe
  "C:\Program Files\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files\Windows Photo Viewer\es-ES\
  2⤵
  PID:580
- C:\Program Files\Windows Photo Viewer\fr-FR\backup.exe
  "C:\Program Files\Windows Photo Viewer\fr-FR\backup.exe" C:\Program Files\Windows Photo Viewer\fr-FR\
  2⤵
  PID:1328
- C:\Program Files\Windows Photo Viewer\it-IT\backup.exe
  "C:\Program Files\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files\Windows Photo Viewer\it-IT\
  2⤵
  PID:2980

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:2312

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:1596

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:2692

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:2848

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
1⤵
PID:2992

C:\Program Files\Common Files\System\msadc\it-IT\data.exe
"C:\Program Files\Common Files\System\msadc\it-IT\data.exe" C:\Program Files\Common Files\System\msadc\it-IT\
1⤵
PID:1444
- C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\
  2⤵
  PID:2984

C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
1⤵
PID:2796

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
1⤵
PID:2532

C:\Program Files\Common Files\System\msadc\en-US\backup.exe
"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
1⤵
PID:2236

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
1⤵
PID:2916

C:\Program Files\Windows Portable Devices\backup.exe
"C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
1⤵
PID:888

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:1928

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
PID:1740

C:\Program Files\backup.exe
"C:\Program Files\backup.exe" C:\Program Files\
1⤵
PID:292
- C:\Program Files\Windows Sidebar\backup.exe
  "C:\Program Files\Windows Sidebar\backup.exe" C:\Program Files\Windows Sidebar\
  2⤵
  PID:1396

C:\PerfLogs\backup.exe
C:\PerfLogs\backup.exe C:\PerfLogs\
1⤵
PID:1764

C:\backup.exe
\backup.exe \
1⤵
PID:2496

C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\
1⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
1⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
1⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
1⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2764

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2264

C:\Users\Admin\AppData\Local\Temp\2754135318\backup.exe
C:\Users\Admin\AppData\Local\Temp\2754135318\backup.exe C:\Users\Admin\AppData\Local\Temp\2754135318\
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1544

C:\Users\Admin\AppData\Local\Temp\078f7b90ee42411ede50da5e66204ca7.exe
"C:\Users\Admin\AppData\Local\Temp\078f7b90ee42411ede50da5e66204ca7.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
34KB

MD5
10ce28dc35738d95dc452d1d227ad329

SHA1
cad26523f640e0dd2757353c327bb63f1c25650c

SHA256
81a1c56b7593eb95c96a9022ed83c5198c212786493a396ed9660c98727ae4ce

SHA512
2e06c3feac350c134f287d9d641180f3e34b34a4e53663cfee35b152755e66fd1547a2bc4fe4cf03f2845b962f6990ce1f747839f651de7ae0ba4d97156ed2d7

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
7KB

MD5
75f39445406761913c4e760a044c1184

SHA1
2621c020137339ce978a716aeaa0187bc803b4fd

SHA256
cf53a7c1eaf30be1a0d0d482b5971138a8614efd47f470003a947009e4ef1ca3

SHA512
a462222b2175748aaed9492adacaf178bedb759d276c9e06594ab03b57d3c1ef73cb76eb9100fd48827346661bd9fd286a08ed52d15bba7a7c1c08fe9afaae13

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
227972687ff3704a12be49b5c8fd789f

SHA1
8453d8c4378d1095beae6423cd2aeb11cffc5481

SHA256
0c0ac12d83e9d177b24752323e97f8760d266dddb85244ede6b7f18912743959

SHA512
4b52afb62f7bed392a158cd02d81d303dcfe8c46e53849ff9612f5cf2fb227fa4884eb7271eef0e624692f4590c64a0c72fbac598fb09187056eb3ec481ea4cf

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
27KB

MD5
1c78dd33473a9bb9dad7767d1b8c3d71

SHA1
1ee3206898c578b553728f1c01fde33ce2ee4d31

SHA256
53630f22d2b3d25b7a34a4130605d3b3e9f6a9d8f93a98cf1937bec21088fe6c

SHA512
66b8de4d522be4ea5af1dca7fd5ae68fcdeb33e6f27159ab7a42409ae968e8c08eb302e35311faccd649af9966b74412faa1a2d57341bfdf16df211368891857

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
280f9ec1565e26480816beb6ce63a984

SHA1
87b575aab70a0075fb7a33f7ac3a8bbf69d166cf

SHA256
8c4a8a2afb1528f4b524c579b2a026ff01fc670245e4f489ef46b9524ae4f7fd

SHA512
a7976f72288c3ebf810be2b487f28983d3977f5704f64ab6e7f86d5a986f577ca8cee2b7a1728d86b9ac005dbb6ad56582116281bd2089b5e1059d6c2366fcaf

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
42eba0bae56436b60a7d0f9603b1dbc8

SHA1
351330e75b1250e7e67a2f2b1d95c1f9d9064598

SHA256
77a176b451e818f188cb0d38509d0b5d7219a34f0f4b4d06be913fc273f9684e

SHA512
ca44c986b760b8be741a079326c25466de003ba5aa949fb071a8ea718552005643b23432fbe2dab54e71acae3a863804b01c61e842732bc9c0f9d231c948eb46

Download Submit
C:\Users\Admin\AppData\Local\Temp\2754135318\backup.exe

Filesize
37KB

MD5
b7894acb7df781a1311f0f97496a0cab

SHA1
0bbeab1446e533a13c7808e806e776422a604eaa

SHA256
742869f675ad5303f3e4617545bd231a2ffd64415efc2ea03723d122bacb7435

SHA512
78f92136758d70f043d20ac0fd3f5b15a50b64be5cd8b729cbd864f13147f7d86fb4015e72b98ba64eea3ac7c74d5853a113f51cb90a86fb4ed0f96f28867e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\2754135318\backup.exe

Filesize
17KB

MD5
5ef81f8d01fde42664129225bfeddf62

SHA1
e45dfe7d826a8ddaf49ca6324a9ac9a1a75a3476

SHA256
3fbfdd28d4c2b444f12356045fc00463386e6026ad03574a052e7cdcd5db21dd

SHA512
a272d6c6ac1b47ba2d162a1450629ed06e19afa7d6042220dc2fa3414ea631ba5efdb0d61034dfe706a923850b5dfc20b61bf352fa1a62f63974791455de84b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2754135318\backup.exe

Filesize
27KB

MD5
60f070b7b153d8589d0f1b555cfd193a

SHA1
70cf5cf40c863f72a8aca0f62b9e2d00c9987a07

SHA256
d13d8354ba6df07fb3875066b3860cfc630b608bb7119850ad8208c7b9a640ba

SHA512
52ae27b74a59cba96458ded3528f4d81e85ede4b29e87544e913fa2c13f44a5b69c074e56041c923791b55feb99f6419b52129e4577adba9df48873aa078ab33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
53KB

MD5
8baa4aeed3a283f40f9093cd5bca4680

SHA1
70407b04f71dc7b1ee5c25a9017f454629a651de

SHA256
27ef3e5f93a7a7721db445acf233643c664f16ce10e94dad98e2de8eaa9937bb

SHA512
c65629bc5dcba77a388aa2611bb6c9fe0fc45993d69e819f8852cd4353957febdefe604502cf6409a3afc38cad702c4fdd8f67428f62f9f6184ab2ca19480ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
13KB

MD5
3c3824820a26fb62d43ef80ad62e4384

SHA1
8e2450b7cba660a4216b69dbbfd6de30e2226472

SHA256
4c1ec458fcca373aa910c9ad81db6a6239819fcf4dfcb808f65fc8c9a5d80f73

SHA512
b3ae87e4696be37d02ab84a271e6a4adfc3806e5e9e1f248490cee3c055502231f0db8749e8b4b5d03e93a7c8e7803e4766586c8c3583346f77cb4359911f7a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
53KB

MD5
685365c60f80c5804bfa2fbba17633fd

SHA1
39c64bf43df8ab81fce29c465099e9711af27791

SHA256
7c63f0500ffa62ba3654283b2dcaaefcca583858ade60abe5ad23fbaf28abef8

SHA512
d09dab569135770015b9ba896aa86bb9f5d58c72ac9b6d36b65125d67238b56e81407112931d73bb18970a1b035247a9f679e4c80fa83652081cf2141f928f3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe

Filesize
72KB

MD5
42cf8267744bb27055a4d126b4f37d06

SHA1
127e25c582bed0fa3135ccb976f4516a6eaaa868

SHA256
cfd3a0d12d9cb5622085267f9e13e7c2e86bd1242250f2905a7426ab150bd597

SHA512
b0452e770dfcdd0242d06ee7973cf5cefdc04f1033df52e37396084e10bae18dceca3b1fb334ef07b91e04254ba24842df1f26db871b446bd560c87984603684

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\backup.exe

Filesize
72KB

MD5
fe8cad4ccf6fc9b0077ba3f68fa3ce9b

SHA1
eff2529f2cfd987473733dc34825c42c0678e3d4

SHA256
cda0990a29f54b8dbe9931b400139fb0ae111b2a4ddc567dc3c7780e6665d8cb

SHA512
45305116754763007397dd69c4428ccdaea20c748d8764525aa3bd60dace0d40aafedf18c1d5b6df6263db8449c3155c675c06380f7e780491ea81c5c890b932

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
22KB

MD5
644968a58cdd28c387df16ad96674cbc

SHA1
d907549217037f55207a14d04dd57df8fde5b3b3

SHA256
88d3bb2de63db45364eca7faeb061a9a4b1b76ee1ba362b12df632023960435b

SHA512
4159b69a2090c73c55864d28192c7df9b84f9cc3c65f63a0876f7eb01b084ab36af3b7f1a88f57531c5262878cfeb11e9bfb103ecf7a797634809d997052c8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
40KB

MD5
bac6a4687d7315229f9ef6ab61d5810d

SHA1
2216569540fccee767aaafbbd63ced93714ea9fd

SHA256
efd2545320a9ad4ea6193a72db6dbb93516d3da9b99bb559acf8dbd19398b40b

SHA512
dfa5a31bb105d00eb8c87eb7961badf725dbae91e013a741676ce5c5ad9b303e21bb50180b361be40e08677e8ce4a8378fd3d48f160fec0485f3c9364ded292e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
39KB

MD5
04df36484b243f26af58f81773bfdf05

SHA1
10f8c6f3b74a80bf0260f256db6cb0abf7480951

SHA256
19fe88693bed48b29ba26ab83ef8ab747469e861604604ee2a08875f384681f0

SHA512
816b5d76f4ba5132f9874618d321a5058270f87595210a1e8a9beb1a0fe81109b431a277f0375064a0bdfde71259fcfadb565f97aa371a36c26614740c8400fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
0a07be52220337561cb6d6ff231faf95

SHA1
e88b07bd9f1ceb020fd1551e235c0e19f2f3a6cf

SHA256
d488423176cc060b51a112b6ea53761c3d783b33a8fa2c597730b4034d746c97

SHA512
fde931acdd9636e1a876a2562c8444c8ce106e344d8a17c20ad008b2ff55649ddfc7263726bc19da8108e17ce0ad4c6cd6a1c3c0a34cad301cc6f4f1812c1fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\backup.exe

Filesize
72KB

MD5
7a036d8439f98fe33438e99f5dba4e47

SHA1
9d5f54d395f5d9c73fb8e5788592989c434b67bd

SHA256
118b88df8e50e268d34c556d455f3ca7304758fa448d95b502a98aa87b127655

SHA512
f5a8cc383ce11cc51a5fd0668c011faef9571e2f7d9c3e6ae7807576ce46001b049ed02e15f141ea7fb102ce2f4881ef719d051f4b0369166e3cb76c69a2ece3

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
21KB

MD5
f459b301074832bfabcbb2bd15d90f3b

SHA1
782e1de5028ebe04285f4fb108de2bb058bb279c

SHA256
b4fb721eab18fd49066460f01b0035321d32ba87775952160dbfcb119f31d164

SHA512
8017c32b016a250fa8bbf18a7eb058aa167366f13758c1b9ac509f5be480bb07b228145e93082b6285a607fb72c217c6fe6a1a2445e28509ce9a024052f8b51d

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
42KB

MD5
a519a9ca21021040adb3379ad4f22437

SHA1
48aeb4d340e43a3cbc9a7917d0e359a1e32df0ac

SHA256
ad75fb23d8058cccfbb25298b83921bc174f6e7f3cc3e2abc8f242fee96e5799

SHA512
da7fe36ba750c1c9e9b0782bc75a41048894ef8e59b5480ca9a7712b5bc5fbad29a7a5555cb37fcc4f55ae6ce0037cad85673690a5ec1e0cf3b84c49362a23d5

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\backup.exe

Filesize
9KB

MD5
8efb9a395f7824ab2be6cb9f3212ca66

SHA1
b58838e800ef575d9b4d5c709e12f59e707e8439

SHA256
4f7e6178dfc1937293a710d7aedf6feaf871e1a6832fa5c87b86fc31050c6399

SHA512
9924a2c735ff301e20a3f9b9b8c0275d892c739e0060e4c2432a7daee46fbafaad6fe069f873a271893c5a48ebe73a91b2486822228b5e010982ae0be45bf019

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
45KB

MD5
8f9248f3605c56bb942783b7d74ebd91

SHA1
4b53ab5417ebf642d87a8102a33cfd2f2f3a3362

SHA256
f2228b6e1f6e4d837500e395f993184e53ab8c3c0e6211715cb7b40a2320e15e

SHA512
e396b9abc24eddb3d08aaa5986637e8976489f9bca95106e0b4d9c4edc9370315e127376299df0c48fd2307674bf97cf35b7aa68a13002aa3993a94142f832aa

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
48KB

MD5
46d2906b0964d7b36fb961b329c5718e

SHA1
18f81d06f1dd48217109395108d0129adb49a90c

SHA256
475c74e57c119e661f5c86f6c13472796810dfb5306ad14bb918975d476ac7e1

SHA512
76369af8b04895ba7bd3af9774c7bf6b56bb48d19ecca89d1fcc03a3038b292f75e0d6c05dae4e40e544e33547bfa1699601f97387c8044b3d00e7bf09b83f85

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
2KB

MD5
4d50da771414eaf5f9da1dac05467ea0

SHA1
5fa9d9fcf9c536b4d27aee53c455dbd22bfa295c

SHA256
c86cf30bc53728b21c80f25dbff6ef006d45f24f4aa46e05f8866f447805e1c0

SHA512
69dde93ce19426636a5117bef2e23573c6ccd3e7cf07413f5c9b49c20e7d4c4110911d7ce1f20360c249a692d320d8446d0488609a81d45111da6658b42576fa

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
40KB

MD5
e337ab1b603a82716049906129e6d4dc

SHA1
cec0e2f44637384732e3017efd127e7d639db8c5

SHA256
67661955926e6d71f00e82363c2c365bc7b1fc290a92664eea7b773547f0e9b2

SHA512
f8dbe121850c0696ab5ae7c9a5926069ddcbd4e06e9b08d54db759d2210130e6ce93ed4e6b6fd713d7813487183a78e4d55f88c16a5953498589fa1f317b72f5

Download Submit
memory/2140-119-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads