6c41b238f0fbb9ba2483138ae85cca1aa28d09dc1dbb0b886f59bb582a5116ba

Analysis

max time kernel
1s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078f7b90ee42411ede50da5e66204ca7.exe
Size

72KB
MD5

078f7b90ee42411ede50da5e66204ca7
SHA1

31282d1d28f15e8a153b9ac4334d0009bb5c8dcd
SHA256

6c41b238f0fbb9ba2483138ae85cca1aa28d09dc1dbb0b886f59bb582a5116ba
SHA512

2ab67cd0a6cf6c260fd83f1706861e13b4480198a80f31007e357c1b3ce2dbf161f3d0c4055fa21f0d66b174f5fc927db472ae102179ff2b4c677c927f8d1d98
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2h:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP1

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 27 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe

Disables RegEdit via registry modification 54 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 28 IoCs

pid	Process
2308	backup.exe
1128	backup.exe
2688	backup.exe
2752	backup.exe
2724	backup.exe
2712	backup.exe
2624	backup.exe
2660	backup.exe
2504	backup.exe
2220	backup.exe
1872	data.exe
2320	backup.exe
1560	backup.exe
1260	backup.exe
1756	backup.exe
2924	backup.exe
2580	backup.exe
324	backup.exe
2980	backup.exe
2880	backup.exe
2564	backup.exe
452	data.exe
2120	backup.exe
1544	backup.exe
304	Process not Found
632	backup.exe
2940	backup.exe
572	backup.exe

Loads dropped DLL 54 IoCs

pid	Process
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2540	backup.exe
2624	backup.exe
2624	backup.exe
2540	backup.exe
2540	backup.exe
2220	backup.exe
2220	backup.exe
1872	data.exe
1872	data.exe
2220	backup.exe
2220	backup.exe
1560	backup.exe
1560	backup.exe
1260	backup.exe
1260	backup.exe
1560	backup.exe
1560	backup.exe
2924	backup.exe
2924	backup.exe
2580	backup.exe
2580	backup.exe
2580	backup.exe
2580	backup.exe
2980	backup.exe
2980	backup.exe
2980	backup.exe
2980	backup.exe
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found
2980	Process not Found

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe	Process not Found
File opened for modification	C:\Program Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe	Process not Found
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe	Process not Found
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe	Process not Found
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe	Process not Found
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe	Process not Found
File opened for modification	C:\Program Files\7-Zip\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	backup.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2540	backup.exe
2308	backup.exe
1128	backup.exe
2688	backup.exe
2752	backup.exe
2724	backup.exe
2712	backup.exe
2624	backup.exe
2660	backup.exe
2504	backup.exe
2220	backup.exe
1872	data.exe
2320	backup.exe
1560	backup.exe
1260	backup.exe
1756	backup.exe
2924	backup.exe
2580	backup.exe
324	backup.exe
2980	backup.exe
2880	backup.exe
2564	backup.exe
452	data.exe
2120	backup.exe
1544	backup.exe
304	Process not Found
632	backup.exe
2940	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2308	2540	backup.exe	1010
PID 2540 wrote to memory of 2308	2540	backup.exe	1010
PID 2540 wrote to memory of 2308	2540	backup.exe	1010
PID 2540 wrote to memory of 2308	2540	backup.exe	1010
PID 2540 wrote to memory of 1128	2540	backup.exe	1009
PID 2540 wrote to memory of 1128	2540	backup.exe	1009
PID 2540 wrote to memory of 1128	2540	backup.exe	1009
PID 2540 wrote to memory of 1128	2540	backup.exe	1009
PID 2540 wrote to memory of 2688	2540	backup.exe	1008
PID 2540 wrote to memory of 2688	2540	backup.exe	1008
PID 2540 wrote to memory of 2688	2540	backup.exe	1008
PID 2540 wrote to memory of 2688	2540	backup.exe	1008
PID 2540 wrote to memory of 2752	2540	backup.exe	1007
PID 2540 wrote to memory of 2752	2540	backup.exe	1007
PID 2540 wrote to memory of 2752	2540	backup.exe	1007
PID 2540 wrote to memory of 2752	2540	backup.exe	1007
PID 2540 wrote to memory of 2724	2540	backup.exe	1006
PID 2540 wrote to memory of 2724	2540	backup.exe	1006
PID 2540 wrote to memory of 2724	2540	backup.exe	1006
PID 2540 wrote to memory of 2724	2540	backup.exe	1006
PID 2540 wrote to memory of 2712	2540	backup.exe	1005
PID 2540 wrote to memory of 2712	2540	backup.exe	1005
PID 2540 wrote to memory of 2712	2540	backup.exe	1005
PID 2540 wrote to memory of 2712	2540	backup.exe	1005
PID 2540 wrote to memory of 2624	2540	backup.exe	874
PID 2540 wrote to memory of 2624	2540	backup.exe	874
PID 2540 wrote to memory of 2624	2540	backup.exe	874
PID 2540 wrote to memory of 2624	2540	backup.exe	874
PID 2624 wrote to memory of 2660	2624	backup.exe	621
PID 2624 wrote to memory of 2660	2624	backup.exe	621
PID 2624 wrote to memory of 2660	2624	backup.exe	621
PID 2624 wrote to memory of 2660	2624	backup.exe	621
PID 2540 wrote to memory of 2504	2540	backup.exe	273
PID 2540 wrote to memory of 2504	2540	backup.exe	273
PID 2540 wrote to memory of 2504	2540	backup.exe	273
PID 2540 wrote to memory of 2504	2540	backup.exe	273
PID 2308 wrote to memory of 2220	2308	backup.exe	1004
PID 2308 wrote to memory of 2220	2308	backup.exe	1004
PID 2308 wrote to memory of 2220	2308	backup.exe	1004
PID 2308 wrote to memory of 2220	2308	backup.exe	1004
PID 2220 wrote to memory of 1872	2220	backup.exe	1003
PID 2220 wrote to memory of 1872	2220	backup.exe	1003
PID 2220 wrote to memory of 1872	2220	backup.exe	1003
PID 2220 wrote to memory of 1872	2220	backup.exe	1003
PID 1872 wrote to memory of 2320	1872	data.exe	1002
PID 1872 wrote to memory of 2320	1872	data.exe	1002
PID 1872 wrote to memory of 2320	1872	data.exe	1002
PID 1872 wrote to memory of 2320	1872	data.exe	1002
PID 2220 wrote to memory of 1560	2220	backup.exe	1001
PID 2220 wrote to memory of 1560	2220	backup.exe	1001
PID 2220 wrote to memory of 1560	2220	backup.exe	1001
PID 2220 wrote to memory of 1560	2220	backup.exe	1001
PID 1560 wrote to memory of 1260	1560	backup.exe	1000
PID 1560 wrote to memory of 1260	1560	backup.exe	1000
PID 1560 wrote to memory of 1260	1560	backup.exe	1000
PID 1560 wrote to memory of 1260	1560	backup.exe	1000
PID 1260 wrote to memory of 1756	1260	backup.exe	999
PID 1260 wrote to memory of 1756	1260	backup.exe	999
PID 1260 wrote to memory of 1756	1260	backup.exe	999
PID 1260 wrote to memory of 1756	1260	backup.exe	999
PID 1560 wrote to memory of 2924	1560	backup.exe	998
PID 1560 wrote to memory of 2924	1560	backup.exe	998
PID 1560 wrote to memory of 2924	1560	backup.exe	998
PID 1560 wrote to memory of 2924	1560	backup.exe	998

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe

C:\Users\Admin\AppData\Local\Temp\078f7b90ee42411ede50da5e66204ca7.exe
"C:\Users\Admin\AppData\Local\Temp\078f7b90ee42411ede50da5e66204ca7.exe"
1⤵
PID:2540
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2504
- C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\backup.exe
  C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\
  2⤵
  PID:2624
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
  2⤵
  PID:1796
- - C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
    3⤵
    PID:2772

C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\
1⤵
PID:2660

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
1⤵
PID:2880

C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
1⤵
PID:452

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:1544

C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
1⤵
PID:632

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:572

C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
1⤵
PID:1176

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
1⤵
PID:1388

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
1⤵
PID:1604
- C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
  2⤵
  PID:2988

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
1⤵
PID:1984

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
1⤵
PID:2340

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
1⤵
PID:2260

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
1⤵
PID:2768

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
1⤵
PID:3020

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
1⤵
PID:2820
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
  2⤵
  PID:2840

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
1⤵
PID:2908

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
1⤵
PID:1532

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
1⤵
PID:1324
- C:\Program Files\Java\jdk1.7.0_80\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
  2⤵
  PID:2692
- - C:\Program Files\Java\jdk1.7.0_80\db\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\
    3⤵
    PID:1332
- - C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
    3⤵
    PID:2880
- - C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
    3⤵
    PID:2192
- - C:\Program Files\Java\jdk1.7.0_80\jre\System Restore.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
    3⤵
    PID:1288
- - C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
    3⤵
    PID:2300
- C:\Program Files\Java\jre7\backup.exe
  "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
  2⤵
  PID:2108

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
1⤵
PID:2556
- C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
  2⤵
  PID:2212

C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
1⤵
PID:656

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
1⤵
PID:1796

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
1⤵
PID:1500

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
1⤵
PID:1908

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
1⤵
PID:1556

C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
1⤵
PID:760

C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
1⤵
PID:944

C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
1⤵
PID:1808

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:1984
- C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
  2⤵
  PID:2340
- - C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
    3⤵
    PID:1428
- - C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
    3⤵
    PID:2476
  - - C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
      4⤵
      PID:2868
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
        5⤵
        
        PID:1044
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
        5⤵
        
        PID:2820
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
        5⤵
        
        PID:3032
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
        5⤵
        
        PID:1340
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
        5⤵
        
        PID:2656
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
        5⤵
        
        PID:2892
  - - C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
      4⤵
      PID:1272
    - - C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
        5⤵
        
        PID:332
      - C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
        6⤵
        
        PID:2188
        
        C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\
        7⤵
        
        PID:1804
    - - C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
        5⤵
        
        PID:2184
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\
        6⤵
        
        PID:2064
    - - C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\images\
        5⤵
        
        PID:2020
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
        6⤵
        
        PID:1148
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
        6⤵
        
        PID:1996
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
        6⤵
        
        PID:2044
    - - C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
        5⤵
        
        PID:2376
      - C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
        6⤵
        
        PID:1060
      - C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\
        6⤵
        
        PID:676
    - - C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\js\
        5⤵
        
        PID:2892
      - C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\
        6⤵
        
        PID:2712
- C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
  2⤵
  PID:2260
- C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
  2⤵
  PID:2904

C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2716
- C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
  2⤵
  PID:2864
- C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
  2⤵
  PID:2584
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:2620

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:1584

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:2772

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:1260

C:\Program Files\Common Files\System\update.exe
"C:\Program Files\Common Files\System\update.exe" C:\Program Files\Common Files\System\
1⤵
PID:1828
- C:\Program Files\Common Files\System\de-DE\System Restore.exe
  "C:\Program Files\Common Files\System\de-DE\System Restore.exe" C:\Program Files\Common Files\System\de-DE\
  2⤵
  PID:1540
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
    3⤵
    PID:884
- - C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
    3⤵
    PID:2552
- C:\Program Files\Common Files\System\en-US\backup.exe
  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
  2⤵
  PID:1544
- C:\Program Files\Common Files\System\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
  2⤵
  PID:2408
- C:\Program Files\Common Files\System\it-IT\backup.exe
  "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
  2⤵
  PID:888
- C:\Program Files\Common Files\System\msadc\backup.exe
  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
  2⤵
  PID:1060
- - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
    3⤵
    PID:2424
  - - C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
      "C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
      4⤵
      PID:1640
- - C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
    3⤵
    PID:2064
- C:\Program Files\Common Files\System\Ole DB\data.exe
  "C:\Program Files\Common Files\System\Ole DB\data.exe" C:\Program Files\Common Files\System\Ole DB\
  2⤵
  PID:1128
- C:\Program Files\Common Files\System\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
  2⤵
  PID:1968
- C:\Program Files\Common Files\System\es-ES\backup.exe
  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
  2⤵
  PID:1088
- C:\Program Files\Common Files\System\ado\backup.exe
  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
  2⤵
  PID:1496

C:\Program Files\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
1⤵
PID:1800

C:\Program Files\Common Files\System\ado\es-ES\backup.exe
"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
1⤵
PID:988

C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
1⤵
PID:2148

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:1148

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:3036

C:\Program Files\DVD Maker\fr-FR\backup.exe
"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
1⤵
PID:2764

C:\Program Files\DVD Maker\it-IT\backup.exe
"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
1⤵
PID:2620

C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
1⤵
PID:1720
- C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
  2⤵
  PID:3024
- C:\Program Files\DVD Maker\Shared\DvdStyles\Full\data.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
  2⤵
  PID:2096
- C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
  2⤵
  PID:1492
- C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\System Restore.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
  2⤵
  PID:2828
- C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
  2⤵
  PID:2808
- C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
  2⤵
  PID:2276
- - C:\Program Files\Mozilla Firefox\browser\features\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
    3⤵
    PID:1800
- - C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
    3⤵
    PID:380
- C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
  2⤵
  PID:676
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
    3⤵
    PID:1052
- C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
  2⤵
  PID:1636

C:\Program Files\Google\Chrome\Application\backup.exe
"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
1⤵
PID:1388

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
1⤵
PID:1576
- C:\Users\Admin\backup.exe
  C:\Users\Admin\backup.exe C:\Users\Admin\
  2⤵
  PID:2444
- - C:\Users\Admin\Contacts\backup.exe
    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
    3⤵
    PID:2172
- - C:\Users\Admin\Desktop\backup.exe
    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
    3⤵
    PID:268
  - - C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
      4⤵
      PID:2576
- - C:\Users\Admin\Documents\backup.exe
    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
    3⤵
    PID:1680
- - C:\Users\Admin\Downloads\backup.exe
    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
    3⤵
    PID:2808
- - C:\Users\Admin\Favorites\backup.exe
    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
    3⤵
    PID:1052
- - C:\Users\Admin\Searches\backup.exe
    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
    3⤵
    PID:2736
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
      4⤵
      PID:2904
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
      4⤵
      PID:1772
  - - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
      4⤵
      PID:3028
- - C:\Users\Admin\Videos\backup.exe
    C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
    3⤵
    PID:844
- - C:\Users\Admin\Saved Games\backup.exe
    "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
    3⤵
    PID:2460
- - C:\Users\Admin\Pictures\backup.exe
    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
    3⤵
    PID:1644
- - C:\Users\Admin\Music\backup.exe
    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
    3⤵
    PID:2016
- - C:\Users\Admin\Links\backup.exe
    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
    3⤵
    PID:1176
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
      4⤵
      PID:3016
- - C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
    3⤵
    PID:1292

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
1⤵
PID:2816
- C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
  2⤵
  PID:900

C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
1⤵
PID:2888
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
  2⤵
  PID:2916
- - C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\
    3⤵
    PID:2604
  - - C:\Users\Public\Recorded TV\Sample Media\backup.exe
      "C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\
      4⤵
      PID:2152
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
  2⤵
  PID:3008

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
1⤵
PID:2760
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
  2⤵
  PID:2628
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
    3⤵
    PID:1984
  - - C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
      4⤵
      PID:2788
- C:\Program Files\Microsoft Games\Purble Place\de-DE\data.exe
  "C:\Program Files\Microsoft Games\Purble Place\de-DE\data.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
  2⤵
  PID:3008

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
1⤵
PID:2916

C:\Program Files\Internet Explorer\de-DE\backup.exe
"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:3036

C:\Program Files\Internet Explorer\fr-FR\backup.exe
"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
1⤵
PID:2764
- C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
  2⤵
  PID:2972
- C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\
  2⤵
  PID:2944
- C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
  2⤵
  PID:452
- C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\
  2⤵
  PID:2456
- - C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
    3⤵
    PID:2152
- - C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
    3⤵
    PID:1400
- - C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
    3⤵
    PID:1880
- - C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
    3⤵
    PID:2012
- - C:\Program Files\Microsoft Games\More Games\en-US\backup.exe
    "C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\
    3⤵
    PID:2672
- - C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
    3⤵
    PID:1964

C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
1⤵
PID:1400

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
1⤵
PID:1668

C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\
1⤵
PID:2980

C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
1⤵
PID:1672
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
  2⤵
  PID:2040

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\update.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
1⤵
PID:2720

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
1⤵
PID:2444

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
1⤵
PID:1428

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
1⤵
PID:112

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
1⤵
PID:2772

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
1⤵
PID:1332
- C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
  2⤵
  PID:692
- C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
  2⤵
  PID:1020

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
1⤵
PID:1116

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
1⤵
PID:632

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
1⤵
PID:2100

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
1⤵
PID:2680

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2032

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2604
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
  2⤵
  PID:2892

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
1⤵
PID:2628

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
1⤵
PID:376

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
1⤵
PID:1644

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
1⤵
PID:2856
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
  2⤵
  PID:2124

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
1⤵
PID:1044

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\
1⤵
PID:2168
- C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
  2⤵
  PID:2620
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
    3⤵
    PID:2716
  - - C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
      4⤵
      PID:2388
  - - C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\System Restore.exe
      "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
      4⤵
      PID:2140
    - - C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
        5⤵
        
        PID:2792
      - C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\
        6⤵
        
        PID:2768
      - C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\
        6⤵
        
        PID:2016
  - - C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
      4⤵
      PID:3036

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
1⤵
PID:1756

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
1⤵
PID:792
- C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\
  2⤵
  PID:2920
- - C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
    3⤵
    PID:2012

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
1⤵
PID:1020
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
  2⤵
  PID:1112
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
    3⤵
    PID:1092
  - - C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
      4⤵
      PID:1088
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\
    3⤵
    PID:1804
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
    3⤵
    PID:1548
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
  2⤵
  PID:1176
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
    3⤵
    PID:2360
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
  2⤵
  PID:2020

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
1⤵
PID:1680
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
  2⤵
  PID:1380
- - C:\Program Files\Mozilla Firefox\browser\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
    3⤵
    PID:2276
- - C:\Program Files\Mozilla Firefox\fonts\data.exe
    "C:\Program Files\Mozilla Firefox\fonts\data.exe" C:\Program Files\Mozilla Firefox\fonts\
    3⤵
    PID:1876
  - - C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\
      4⤵
      PID:2400
- - C:\Program Files\Mozilla Firefox\uninstall\backup.exe
    "C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
    3⤵
    PID:2160
- - C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\
    3⤵
    PID:2016

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
1⤵
PID:912
- C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
  2⤵
  PID:676

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
1⤵
PID:944
- C:\Program Files\Microsoft Games\FreeCell\de-DE\System Restore.exe
  "C:\Program Files\Microsoft Games\FreeCell\de-DE\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
  2⤵
  PID:2100
- C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
  2⤵
  PID:2360
- C:\Program Files\Microsoft Games\FreeCell\it-IT\update.exe
  "C:\Program Files\Microsoft Games\FreeCell\it-IT\update.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
  2⤵
  PID:2428
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
    3⤵
    PID:2400
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
    3⤵
    PID:2592
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\data.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
    3⤵
    PID:1524
  - - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
      4⤵
      PID:344
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\
    3⤵
    PID:2572
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\
    3⤵
    PID:3052
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
    3⤵
    PID:452
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
    3⤵
    PID:2840
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\
      4⤵
      PID:2180
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\data.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\
      4⤵
      PID:1752
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
    3⤵
    PID:948
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
      4⤵
      PID:1120
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
    3⤵
    PID:2112
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\
    3⤵
    PID:2452
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
    3⤵
    PID:2924
  - - C:\Program Files\Common Files\SpeechEngines\backup.exe
      "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
      4⤵
      PID:1936
    - - C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\
        5⤵
        
        PID:2916
      - C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\
        6⤵
        
        PID:2928
    - - C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\
        5⤵
        
        PID:2452
      - C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
        6⤵
        
        PID:2188
  - - C:\Program Files\Common Files\Microsoft Shared\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2580
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\
    3⤵
    PID:2180
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
    3⤵
    PID:2216
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
    3⤵
    PID:2292
  - - C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
      4⤵
      PID:632
    - - C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
        5⤵
        
        PID:2992
  - - C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\art\
      4⤵
      PID:304
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\
    3⤵
    PID:348
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\
    3⤵
    PID:1056
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\
    3⤵
    PID:2196
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\
    3⤵
    PID:1636
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\
    3⤵
    PID:2760
  - - C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
      4⤵
      PID:376
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
        5⤵
        
        PID:1388
      - C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
        6⤵
        
        PID:2452
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\System Restore.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\System Restore.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
        6⤵
        
        PID:604
  - - C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\
      4⤵
      PID:2028
  - - C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
      4⤵
      PID:2612
  - - C:\Program Files\Microsoft Games\Purble Place\es-ES\update.exe
      "C:\Program Files\Microsoft Games\Purble Place\es-ES\update.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\
      4⤵
      PID:2788
  - - C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
      4⤵
      PID:1960
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\
    3⤵
    PID:1892
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\
    3⤵
    PID:1572
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\
    3⤵
    PID:1952
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\
    3⤵
    PID:1644
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\
    3⤵
    PID:2212
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\
    3⤵
    PID:1636
  - - C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
      4⤵
      PID:884
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
        5⤵
        
        PID:2992
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
    3⤵
    PID:1672
  - - C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
      4⤵
      PID:2740
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\
    3⤵
    PID:2100
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\
    3⤵
    PID:2252
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\
    3⤵
    PID:2784
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
    3⤵
    PID:1812
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
    3⤵
    PID:1216
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
    3⤵
    PID:2336
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\data.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
    3⤵
    PID:884
  - - C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
      4⤵
      PID:2728
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\
    3⤵
    PID:944
  - - C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
      4⤵
      PID:844
  - - C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
      4⤵
      PID:2336
  - - C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
      "C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
      4⤵
      PID:2832
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
    3⤵
    PID:2976
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
    3⤵
    PID:1304
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
    3⤵
    PID:320
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
    3⤵
    PID:2148
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
    3⤵
    PID:496
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
    3⤵
    PID:352
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\
    3⤵
    PID:2388
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
    3⤵
    PID:2340
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\
    3⤵
    PID:2888
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\
    3⤵
    PID:2864
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
    3⤵
    PID:1216

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
1⤵
PID:1780
- C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\
  2⤵
  PID:2348
- - C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
    3⤵
    PID:312
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
      4⤵
      PID:2324
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
      4⤵
      PID:1636

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
1⤵
PID:2868

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
1⤵
PID:1752

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
1⤵
PID:2876
- C:\Users\Public\Documents\backup.exe
  C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
  2⤵
  PID:2956
- C:\Users\Public\Music\backup.exe
  C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
  2⤵
  PID:656
- - C:\Users\Public\Music\Sample Music\backup.exe
    "C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\
    3⤵
    PID:2468
- C:\Users\Public\Pictures\data.exe
  C:\Users\Public\Pictures\data.exe C:\Users\Public\Pictures\
  2⤵
  PID:2112
- - C:\Users\Public\Pictures\Sample Pictures\backup.exe
    "C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
    3⤵
    PID:3008
- C:\Users\Public\Videos\backup.exe
  C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
  2⤵
  PID:872
- - C:\Users\Public\Videos\Sample Videos\backup.exe
    "C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\
    3⤵
    PID:2948
  - - C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
      4⤵
      PID:1808
- C:\Users\Public\Recorded TV\backup.exe
  "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
  2⤵
  PID:2604
- - C:\Program Files (x86)\Common Files\Adobe AIR\Versions\data.exe
    "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
    3⤵
    PID:2340
  - - C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
      4⤵
      PID:2700
- C:\Users\Public\Downloads\backup.exe
  C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
  2⤵
  PID:1288

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
1⤵
PID:2956

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
1⤵
PID:2920

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
1⤵
PID:1756
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\
  2⤵
  PID:1304
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
  2⤵
  PID:1612

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
1⤵
PID:2156
- C:\Program Files (x86)\Google\CrashReports\backup.exe
  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
  2⤵
  PID:2148

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\
1⤵
PID:1908

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
1⤵
PID:1120

C:\Program Files\Java\jre7\lib\applet\backup.exe
"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
1⤵
PID:1020

C:\Program Files\Java\jre7\lib\ext\backup.exe
"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
1⤵
PID:2548

C:\Program Files\Java\jre7\lib\images\backup.exe
"C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
1⤵
PID:2852

C:\Program Files\Java\jre7\lib\jfr\backup.exe
"C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
1⤵
PID:2612
- C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
  2⤵
  PID:1812

C:\Program Files\Java\jre7\lib\security\backup.exe
"C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
1⤵
PID:1428

C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
1⤵
PID:112

C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
1⤵
PID:1660

C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
1⤵
PID:2936

C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
1⤵
PID:2920

C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
1⤵
PID:656

C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
1⤵
PID:1748
- C:\Program Files (x86)\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:1028
- - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
    3⤵
    PID:1580
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
      4⤵
      PID:948
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        5⤵
        
        PID:1284
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        5⤵
        
        PID:1152
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
        5⤵
        
        PID:1128
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
        6⤵
        
        PID:2620
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
        6⤵
        
        PID:2096
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
        7⤵
        
        PID:1964
        
        C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
        8⤵
        
        PID:2972
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
      4⤵
      PID:2324
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
        5⤵
        
        PID:2424
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
        5⤵
        
        PID:2860
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
        6⤵
        
        PID:2656
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
        7⤵
        
        PID:1868
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
        7⤵
        
        PID:3008
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
        6⤵
        
        PID:2648
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
      4⤵
      PID:2808
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:2156
- - C:\Program Files (x86)\Google\Update\System Restore.exe
    "C:\Program Files (x86)\Google\Update\System Restore.exe" C:\Program Files (x86)\Google\Update\
    3⤵
    PID:2272
  - - C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Google\Update\Install\backup.exe
      "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
      4⤵
      PID:788
    - - C:\Program Files (x86)\Google\Update\Install\{F233FC20-BAD7-4319-A416-C4D060784296}\backup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{F233FC20-BAD7-4319-A416-C4D060784296}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{F233FC20-BAD7-4319-A416-C4D060784296}\
        5⤵
        
        PID:1720
  - - C:\Program Files (x86)\Google\Update\Offline\backup.exe
      "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
      4⤵
      PID:1580
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        5⤵
        
        PID:2976
  - - C:\Program Files (x86)\Google\Update\Download\data.exe
      "C:\Program Files (x86)\Google\Update\Download\data.exe" C:\Program Files (x86)\Google\Update\Download\
      4⤵
      PID:1972
- - C:\Program Files (x86)\Google\Temp\backup.exe
    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
    3⤵
    PID:1796
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:2228
- - C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
    3⤵
    PID:1872
- - C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
    "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
    3⤵
    PID:2400
  - - C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
      "C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
      4⤵
      PID:2616
- - C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
    "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
    3⤵
    PID:2708
- - C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
    "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
    3⤵
    PID:1804
- - C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
    "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
    3⤵
    PID:2424
  - - C:\Program Files\Java\jre7\bin\server\backup.exe
      "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
      4⤵
      PID:1604
  - - C:\Program Files\Java\jre7\bin\plugin2\backup.exe
      "C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
      4⤵
      PID:3068
- C:\Program Files (x86)\Common Files\backup.exe
  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
  2⤵
  PID:2480
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
    3⤵
    PID:1156

C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
1⤵
PID:2828

C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
"C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
1⤵
PID:1304

C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
1⤵
PID:2540
- C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\
  2⤵
  PID:2484

C:\Program Files\Microsoft Games\Chess\backup.exe
"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
1⤵
PID:1876
- C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
  2⤵
  PID:1496
- C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
  2⤵
  PID:1948

C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
1⤵
PID:2740

C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
1⤵
PID:2952

C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
1⤵
PID:2592

C:\Program Files\Microsoft Games\Mahjong\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
1⤵
PID:2056
- C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
  2⤵
  PID:2696
- C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
  2⤵
  PID:3032
- C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
  2⤵
  PID:2632
- C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
  2⤵
  PID:1340
- C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
  2⤵
  PID:1752
- C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
  2⤵
  PID:1128
- - C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
    3⤵
    PID:2056
- - C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
    3⤵
    PID:2844
- - C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
    3⤵
    PID:2460
- - C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
    3⤵
    PID:2848
- - C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
    3⤵
    PID:2832

C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
1⤵
PID:2968
- C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
  2⤵
  PID:1532
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
    3⤵
    PID:324

C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
1⤵
PID:1848

C:\Program Files\Microsoft Games\Multiplayer\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
1⤵
PID:2108
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\
  2⤵
  PID:2804
- - C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
    3⤵
    PID:1808
- - C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
    3⤵
    PID:1708
- C:\Program Files\Microsoft Games\Multiplayer\Spades\update.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
  2⤵
  PID:1968
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\
    3⤵
    PID:1020
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
      4⤵
      PID:312
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
    3⤵
    PID:2248
  - - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
      4⤵
      PID:1640
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
    3⤵
    PID:2340
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
    3⤵
    PID:2784
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
    3⤵
    PID:2748
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
    3⤵
    PID:1884
- C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
  2⤵
  PID:2888
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2624
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
    3⤵
    PID:3000

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\
1⤵
PID:2408

C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
1⤵
PID:3040

C:\Program Files\Microsoft Games\Solitaire\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
1⤵
PID:624
- C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
  2⤵
  PID:1660
- C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
  2⤵
  PID:756
- C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\
  2⤵
  PID:3060
- C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\
  2⤵
  PID:1872
- - C:\PerfLogs\Admin\backup.exe
    C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2320
- C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
  2⤵
  PID:1860

C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
1⤵
PID:2920

C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\
1⤵
PID:308

C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
1⤵
PID:2528

C:\Program Files\Microsoft Office\Office14\backup.exe
"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
1⤵
PID:2008

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
1⤵
PID:2284
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
  2⤵
  PID:1996
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
  2⤵
  PID:1060
- - C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
    "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
    3⤵
    PID:1600
- - C:\Program Files\Common Files\System\msadc\fr-FR\data.exe
    "C:\Program Files\Common Files\System\msadc\fr-FR\data.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
    3⤵
    PID:880
- - C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
    3⤵
    PID:1504
- - C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
    "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
    3⤵
    PID:2552

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
1⤵
PID:2812

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:1732

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
1⤵
PID:2280

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\update.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
1⤵
PID:2388
- C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
  2⤵
  PID:2084

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
1⤵
PID:2716
- C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\
  2⤵
  PID:3048

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
1⤵
PID:1288

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:1856
- C:\Program Files\VideoLAN\VLC\backup.exe
  "C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
  2⤵
  PID:2296
- C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
  2⤵
  PID:1440
- C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
  2⤵
  PID:812
- C:\Program Files\Java\jre7\lib\zi\America\Indiana\update.exe
  "C:\Program Files\Java\jre7\lib\zi\America\Indiana\update.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
  2⤵
  PID:2600

C:\Program Files\VideoLAN\VLC\locale\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
1⤵
PID:1936
- C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
  2⤵
  PID:1768
- - C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
    3⤵
    PID:2880
  - - C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
      4⤵
      PID:2528
- C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
  2⤵
  PID:2008
- C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
  2⤵
  PID:2580
- - C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
    3⤵
    PID:2336
- - C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
    3⤵
    PID:356
- - C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
    3⤵
    PID:1884
- - C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
    3⤵
    PID:1604
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
    3⤵
    PID:1576
- - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe
    "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
    3⤵
    PID:2248
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
    3⤵
    PID:2280
- - C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2980
- - C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:324
- C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
  2⤵
  PID:2748
- C:\Program Files\VideoLAN\VLC\locale\co\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\
  2⤵
  PID:2628
- - C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
    3⤵
    PID:2280
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
    3⤵
    PID:3020
  - - C:\Program Files\Windows Media Player\es-ES\backup.exe
      "C:\Program Files\Windows Media Player\es-ES\backup.exe" C:\Program Files\Windows Media Player\es-ES\
      4⤵
      PID:792
  - - C:\Program Files\Windows Media Player\fr-FR\backup.exe
      "C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
      4⤵
      PID:2192
  - - C:\Program Files\Windows Media Player\it-IT\backup.exe
      "C:\Program Files\Windows Media Player\it-IT\backup.exe" C:\Program Files\Windows Media Player\it-IT\
      4⤵
      PID:1148
  - - C:\Program Files\Windows Media Player\ja-JP\backup.exe
      "C:\Program Files\Windows Media Player\ja-JP\backup.exe" C:\Program Files\Windows Media Player\ja-JP\
      4⤵
      PID:2600
  - - C:\Program Files\Windows Media Player\Media Renderer\backup.exe
      "C:\Program Files\Windows Media Player\Media Renderer\backup.exe" C:\Program Files\Windows Media Player\Media Renderer\
      4⤵
      PID:552
  - - C:\Program Files\Windows Media Player\Network Sharing\backup.exe
      "C:\Program Files\Windows Media Player\Network Sharing\backup.exe" C:\Program Files\Windows Media Player\Network Sharing\
      4⤵
      PID:2868
- C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
  2⤵
  PID:1328
- - C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
    3⤵
    PID:3052
- C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
  2⤵
  PID:2292
- - C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\
    3⤵
    PID:1336
- C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
  2⤵
  PID:2008
- - C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
    3⤵
    PID:2948
- C:\Program Files\VideoLAN\VLC\locale\es\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\
  2⤵
  PID:2348
- C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
  2⤵
  PID:2940
- - C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\
    3⤵
    PID:2160
- C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
  2⤵
  PID:2476
- - C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
    3⤵
    PID:2696
- C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\
  2⤵
  PID:1684
- - C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
    3⤵
    PID:1488
- C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
  2⤵
  PID:2440
- - C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
    3⤵
    PID:872
- - C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
    3⤵
    PID:1892
- - C:\Program Files\Microsoft Games\Purble Place\update.exe
    "C:\Program Files\Microsoft Games\Purble Place\update.exe" C:\Program Files\Microsoft Games\Purble Place\
    3⤵
    PID:2760
- - C:\Program Files\Microsoft Games\More Games\backup.exe
    "C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\
    3⤵
    PID:2456
- - C:\Program Files\Microsoft Games\Minesweeper\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\
    3⤵
    PID:804
- - C:\Program Files\Microsoft Games\Hearts\backup.exe
    "C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
    3⤵
    PID:1624
- - C:\Program Files\Microsoft Games\FreeCell\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
    3⤵
    PID:944
- C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
  2⤵
  PID:2460
- - C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
    3⤵
    PID:3064
- C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\
  2⤵
  PID:2704
- - C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
    3⤵
    PID:2868
- C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\
  2⤵
  PID:2884
- C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
  2⤵
  PID:1608
- C:\Program Files\VideoLAN\VLC\locale\kk\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\kk\data.exe" C:\Program Files\VideoLAN\VLC\locale\kk\
  2⤵
  PID:1644
- C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\
  2⤵
  PID:1732
- C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\
  2⤵
  PID:2216
- - C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
    3⤵
    PID:1400
- C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\
  2⤵
  PID:1980
- C:\Program Files\VideoLAN\VLC\locale\ky\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\ky\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
  2⤵
  PID:916
- - C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
    3⤵
    PID:356
- C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
  2⤵
  PID:1348
- - C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
    3⤵
    PID:2980
  - - C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
      4⤵
      PID:872
  - - C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
      4⤵
      PID:2808
  - - C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
      4⤵
      PID:344
  - - C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
      4⤵
      PID:324
  - - C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
      4⤵
      PID:2456
  - - C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
      4⤵
      PID:3052
  - - C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
      4⤵
      PID:2320
  - - C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
      4⤵
      PID:2484
  - - C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
      4⤵
      PID:1848
  - - C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\update.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
      4⤵
      PID:2600
  - - C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
      4⤵
      PID:3028
  - - C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\System Restore.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
      4⤵
      PID:2876
  - - C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
      4⤵
      PID:2668
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
      4⤵
      PID:2988
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
      4⤵
      PID:2992
  - - C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2940
  - - C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
      4⤵
      PID:304
  - - C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2120
  - - C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2564
- - C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access\
    3⤵
    PID:2144
- - C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\access_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access_output\
    3⤵
    PID:2016
- - C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
    3⤵
    PID:1268
- - C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\
    3⤵
    PID:1088
- - C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_output\
    3⤵
    PID:348
- - C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\codec\
    3⤵
    PID:2544
- - C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\control\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\control\
    3⤵
    PID:2256
- - C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
    3⤵
    PID:3052
- C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\
  2⤵
  PID:1304
- - C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
    3⤵
    PID:1616
- C:\Program Files\VideoLAN\VLC\locale\lv\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\lv\data.exe" C:\Program Files\VideoLAN\VLC\locale\lv\
  2⤵
  PID:2008
- - C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
    3⤵
    PID:2832
- - C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
    3⤵
    PID:788
- - C:\Program Files\Microsoft Office\Office14\1033\backup.exe
    "C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
    3⤵
    PID:2376
- C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
  2⤵
  PID:2784
- - C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\update.exe
    "C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
    3⤵
    PID:2016
- C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
  2⤵
  PID:1820
- C:\Program Files\VideoLAN\VLC\locale\ps\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\ps\update.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
  2⤵
  PID:812
- - C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\
    3⤵
    PID:2084
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
      4⤵
      PID:2704
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
      4⤵
      PID:2016
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\update.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\
      4⤵
      PID:1216
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
      4⤵
      PID:3004
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
      4⤵
      PID:2428
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
      4⤵
      PID:1720
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\data.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
        5⤵
        
        PID:1012
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
        5⤵
        
        PID:684
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
        5⤵
        
        PID:2948
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
        5⤵
        
        PID:1888
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
        5⤵
        
        PID:2976
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\data.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:452
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
        5⤵
        
        PID:1680
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
        5⤵
        
        PID:1880
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
        5⤵
        
        PID:1268
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
        5⤵
        
        PID:1964
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
        5⤵
        
        PID:1892
    - - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
        5⤵
        
        PID:2196
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
      4⤵
      PID:1968
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
      4⤵
      PID:888
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
      4⤵
      PID:712
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
      4⤵
      PID:1088
- C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\
  2⤵
  PID:2704
- - C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
    3⤵
    PID:1272
- C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\
  2⤵
  PID:2852
- - C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\
    3⤵
    PID:916
- - C:\Program Files\Java\jre7\lib\images\cursors\backup.exe
    "C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\
    3⤵
    PID:1752
- C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\
  2⤵
  PID:1996
- - C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
    3⤵
    PID:1060
- C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\
  2⤵
  PID:2892
- C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\
  2⤵
  PID:2756
- - C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\
    3⤵
    PID:2780
- C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\
  2⤵
  PID:1612
- - C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\
    3⤵
    PID:2688
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\2771377195\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2771377195\backup.exe C:\Users\Admin\AppData\Local\Temp\2771377195\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2308
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
    3⤵
    PID:2212
- C:\Program Files\VideoLAN\VLC\locale\te\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\te\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\
  2⤵
  PID:1616
- - C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\
    3⤵
    PID:1244
  - - C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\
      4⤵
      PID:2732
    - - C:\Program Files\Windows Defender\ja-JP\backup.exe
        
        "C:\Program Files\Windows Defender\ja-JP\backup.exe" C:\Program Files\Windows Defender\ja-JP\
        5⤵
        
        PID:2696
    - - C:\Program Files\Windows Defender\fr-FR\backup.exe
        
        "C:\Program Files\Windows Defender\fr-FR\backup.exe" C:\Program Files\Windows Defender\fr-FR\
        5⤵
        
        PID:2548
- C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\
  2⤵
  PID:2096
- - C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
    3⤵
    PID:1976
  - - C:\Program Files\Windows Mail\de-DE\backup.exe
      "C:\Program Files\Windows Mail\de-DE\backup.exe" C:\Program Files\Windows Mail\de-DE\
      4⤵
      PID:2660
    - - C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
        5⤵
        
        PID:2640
  - - C:\Program Files\Windows Mail\en-US\backup.exe
      "C:\Program Files\Windows Mail\en-US\backup.exe" C:\Program Files\Windows Mail\en-US\
      4⤵
      PID:2888
  - - C:\Program Files\Windows Mail\es-ES\backup.exe
      "C:\Program Files\Windows Mail\es-ES\backup.exe" C:\Program Files\Windows Mail\es-ES\
      4⤵
      PID:1732
  - - C:\Program Files\Windows Mail\ja-JP\backup.exe
      "C:\Program Files\Windows Mail\ja-JP\backup.exe" C:\Program Files\Windows Mail\ja-JP\
      4⤵
      PID:2828
  - - C:\Program Files\Windows Mail\it-IT\backup.exe
      "C:\Program Files\Windows Mail\it-IT\backup.exe" C:\Program Files\Windows Mail\it-IT\
      4⤵
      PID:764
  - - C:\Program Files\Windows Mail\fr-FR\backup.exe
      "C:\Program Files\Windows Mail\fr-FR\backup.exe" C:\Program Files\Windows Mail\fr-FR\
      4⤵
      PID:1556
- C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
  2⤵
  PID:2928
- - C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\
    3⤵
    PID:2772
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
      4⤵
      PID:2456
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
      4⤵
      PID:356
  - - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
      4⤵
      PID:2692
- C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\
  2⤵
  PID:1156
- - C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
    3⤵
    PID:1584
- C:\Program Files\VideoLAN\VLC\locale\uz\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\uz\update.exe" C:\Program Files\VideoLAN\VLC\locale\uz\
  2⤵
  PID:756
- - C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\
    3⤵
    PID:2752
  - - C:\Program Files\Reference Assemblies\Microsoft\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
      4⤵
      PID:2496
- C:\Program Files\VideoLAN\VLC\locale\vi\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\vi\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\vi\
  2⤵
  PID:2764
- - C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
    3⤵
    PID:1544
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
    3⤵
    PID:916
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
    3⤵
    PID:2172
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\
    3⤵
    PID:2180
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
    3⤵
    PID:1860
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\
    3⤵
    PID:2200
- C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\
  2⤵
  PID:1244
- C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\
  2⤵
  PID:552
- C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\
  2⤵
  PID:1380
- - C:\Program Files\Mozilla Firefox\gmp-clearkey\data.exe
    "C:\Program Files\Mozilla Firefox\gmp-clearkey\data.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
    3⤵
    PID:1600
- - C:\Program Files\Mozilla Firefox\defaults\backup.exe
    "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
    3⤵
    PID:712
- C:\Program Files\VideoLAN\VLC\locale\th\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\th\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\
  2⤵
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
    3⤵
    PID:1288
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
      4⤵
      PID:2084
  - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
      4⤵
      PID:3012
- C:\Program Files\VideoLAN\VLC\locale\tet\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\tet\update.exe" C:\Program Files\VideoLAN\VLC\locale\tet\
  2⤵
  PID:2916
- C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\
  2⤵
  PID:1984
- C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
  2⤵
  PID:1780
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
    3⤵
    PID:1708
- C:\Program Files\VideoLAN\VLC\locale\si\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\si\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\
  2⤵
  PID:2948
- C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
  2⤵
  PID:2468
- C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
  2⤵
  PID:268
- C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
  2⤵
  PID:880
- C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
  2⤵
  PID:2612
- C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
  2⤵
  PID:1604
- C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
  2⤵
  PID:884
- C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
  2⤵
  PID:632
- - C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
    3⤵
    PID:1584
- C:\Program Files\VideoLAN\VLC\locale\nl\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\nl\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\nl\
  2⤵
  PID:912
- C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
  2⤵
  PID:2176
- - C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
    3⤵
    PID:1796
- C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
  2⤵
  PID:2816
- C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
  2⤵
  PID:1964
- C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
  2⤵
  PID:2500
- C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
  2⤵
  PID:2444
- C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
  2⤵
  PID:1624
- C:\Program Files\VideoLAN\VLC\locale\mai\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\mai\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
  2⤵
  PID:2428
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
    3⤵
    PID:2044
- C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
  2⤵
  PID:2788
- C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
  2⤵
  PID:2544
- C:\Program Files\VideoLAN\VLC\locale\it\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\
  2⤵
  PID:576
- C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
  2⤵
  PID:1616
- C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
  2⤵
  PID:2968
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
    3⤵
    PID:2600
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
    3⤵
    PID:2460
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:2868
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:2796
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
    3⤵
    PID:2184
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\System Restore.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
    3⤵
    PID:1780
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:2344
  - - C:\Program Files\DVD Maker\Shared\backup.exe
      "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
      4⤵
      PID:2324
  - - C:\Program Files\DVD Maker\ja-JP\backup.exe
      "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
      4⤵
      PID:2672
  - - C:\Program Files\DVD Maker\es-ES\backup.exe
      "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
      4⤵
      PID:2696
    - - C:\Windows\AppPatch\AppPatch64\backup.exe
        
        C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
        5⤵
        
        PID:776
    - - C:\Windows\AppPatch\Custom\backup.exe
        
        C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\
        5⤵
        
        PID:1612
      - C:\Windows\AppPatch\Custom\Custom64\backup.exe
        
        C:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\
        6⤵
        
        PID:1516
    - - C:\Windows\AppPatch\de-DE\System Restore.exe
        
        "C:\Windows\AppPatch\de-DE\System Restore.exe" C:\Windows\AppPatch\de-DE\
        5⤵
        
        PID:2444
    - - C:\Windows\AppPatch\en-US\backup.exe
        
        C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
        5⤵
        
        PID:2640
    - - C:\Windows\AppPatch\es-ES\backup.exe
        
        C:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\
        5⤵
        
        PID:1316
    - - C:\Windows\AppPatch\fr-FR\backup.exe
        
        C:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\fr-FR\
        5⤵
        
        PID:916
  - - C:\Program Files\DVD Maker\en-US\backup.exe
      "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
      4⤵
      PID:1648
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
    3⤵
    PID:904
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
    3⤵
    PID:1544
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
    3⤵
    PID:948
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\System Restore.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
    3⤵
    PID:872
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
    3⤵
    PID:2272
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
    3⤵
    PID:2148
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
    3⤵
    PID:900
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
    3⤵
    PID:1768
- C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\
  2⤵
  PID:792
- C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\
  2⤵
  PID:2340
- C:\Program Files\VideoLAN\VLC\locale\he\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2660
- C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\
  2⤵
  PID:2336
- C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
  2⤵
  PID:1540
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
    3⤵
    PID:2144
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\
    3⤵
    PID:676
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
    3⤵
    PID:872
- C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
  2⤵
  PID:632
- C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
  2⤵
  PID:2176
- C:\Program Files\VideoLAN\VLC\locale\fr\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\fr\data.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
  2⤵
  PID:2168
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
    3⤵
    PID:840
- C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\
  2⤵
  PID:2500
- C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
  2⤵
  PID:808
- C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
  2⤵
  PID:1884
- C:\Program Files\VideoLAN\VLC\locale\el\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\
  2⤵
  PID:2540
- C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
  2⤵
  PID:1796
- C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
  2⤵
  PID:2684
- C:\Program Files\VideoLAN\VLC\locale\ckb\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\ckb\data.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\
  2⤵
  PID:2340
- C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
  2⤵
  PID:1672
- C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
  2⤵
  PID:1876
- - C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\
    3⤵
    PID:912
- - C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
    3⤵
    PID:1544
- - C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
    3⤵
    PID:764
- - C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
    3⤵
    PID:2484
- C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
  2⤵
  PID:1636
- C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
  2⤵
  PID:1092
- C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
  2⤵
  PID:2528
- C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
  2⤵
  PID:2920
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
    3⤵
    PID:3052
- C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\
  2⤵
  PID:2264
- C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
  2⤵
  PID:2388
- C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
  2⤵
  PID:2500
- C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
  2⤵
  PID:2108
- - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
    3⤵
    PID:2636
- - C:\Program Files\Java\jre7\lib\backup.exe
    "C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
    3⤵
    PID:2944
- - C:\Program Files\Java\jre7\bin\backup.exe
    "C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
    3⤵
    PID:2424
- C:\Program Files\VideoLAN\VLC\locale\as_IN\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\as_IN\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
  2⤵
  PID:2164
- C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
  2⤵
  PID:2092
- C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
  2⤵
  PID:2556
- C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
  2⤵
  PID:2212

C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
1⤵
PID:2740

C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
1⤵
PID:2848

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
1⤵
PID:2924

C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
1⤵
PID:1648

C:\Program Files (x86)\Common Files\Adobe\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
1⤵
PID:572
- C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
  2⤵
  PID:1120
- C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
  2⤵
  PID:684

C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
1⤵
PID:1876
- C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
  2⤵
  PID:1504

C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
1⤵
PID:2604

C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
1⤵
PID:1732

C:\Program Files (x86)\Common Files\DESIGNER\update.exe
"C:\Program Files (x86)\Common Files\DESIGNER\update.exe" C:\Program Files (x86)\Common Files\DESIGNER\
1⤵
PID:3032

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
1⤵
PID:1044

C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
1⤵
PID:2904

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
1⤵
PID:2140
- C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
  2⤵
  PID:1700
- - C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
    3⤵
    PID:2672
- C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
  2⤵
  PID:2688
- C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\
  2⤵
  PID:2324
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
    3⤵
    PID:1532
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
    3⤵
    PID:2652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
    3⤵
    PID:1176
- C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
  2⤵
  PID:692
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
  2⤵
  PID:1524
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
    3⤵
    PID:1640
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
    3⤵
    PID:2824
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
    3⤵
    PID:2040
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
    3⤵
    PID:2640
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
  2⤵
  PID:1444
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\
    3⤵
    PID:2332
  - - C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe" C:\Program Files\Java\jre7\lib\zi\Europe\
      4⤵
      PID:2204
  - - C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
      4⤵
      PID:1792
  - - C:\Program Files\Java\jre7\lib\zi\America\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
      4⤵
      PID:1856
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
    3⤵
    PID:2124
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
    3⤵
    PID:2600
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\
      4⤵
      PID:112
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\System Restore.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
      4⤵
      PID:840
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
        5⤵
        
        PID:1892
      - C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
        6⤵
        
        PID:1796
      - C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe
        
        "C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
        6⤵
        
        PID:2156
      - C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
        
        "C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
        6⤵
        
        PID:1260
        
        C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1756
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
        5⤵
        
        PID:656
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
        5⤵
        
        PID:792
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
        6⤵
        
        PID:1964
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
      4⤵
      PID:2356
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
        5⤵
        
        PID:2328
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
      4⤵
      PID:692
    - - C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
        5⤵
        
        PID:1156
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
      4⤵
      PID:2344
    - - C:\Program Files\MSBuild\Microsoft\backup.exe
        
        "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
        5⤵
        
        PID:1608
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
      4⤵
      PID:2804
    - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\
        5⤵
        
        PID:3004
    - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\
        5⤵
        
        PID:2032
    - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe
        
        "C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\
        5⤵
        
        PID:2192
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
        6⤵
        
        PID:2796
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
        6⤵
        
        PID:2320
    - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\data.exe
        
        "C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\data.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\
        5⤵
        
        PID:904
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
      4⤵
      Executes dropped EXE
      PID:572
    - - C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
        5⤵
        
        PID:2548
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
      4⤵
      PID:344
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\
      4⤵
      PID:2808
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
        5⤵
        
        PID:1880
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\update.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\
      4⤵
      PID:904
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\
      4⤵
      PID:2292
- C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\
  2⤵
  PID:1868
- - C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
    3⤵
    PID:2744
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
    3⤵
    PID:2764
- C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\
  2⤵
  PID:2200
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
  2⤵
  PID:1732
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
    3⤵
    PID:1440
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
    3⤵
    PID:2172
  - - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\data.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
      4⤵
      PID:2884
    - - C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\
        5⤵
        
        PID:2264
      - C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
        6⤵
        
        PID:3024
- C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
  2⤵
  PID:356
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\
    3⤵
    PID:1580
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
    3⤵
    PID:2976
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\
    3⤵
    PID:1352
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\
    3⤵
    PID:876
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
    3⤵
    PID:1640
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
    3⤵
    PID:1348
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
    3⤵
    PID:2528
  - - C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
      4⤵
      PID:2272
- C:\Program Files (x86)\Common Files\microsoft shared\Triedit\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
  2⤵
  PID:2840
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
    3⤵
    PID:2124
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2880
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\
    3⤵
    PID:2820
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\
  2⤵
  PID:1516
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
  2⤵
  PID:2428
- - C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\
    3⤵
    PID:2836
- C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
  2⤵
  PID:1488
- C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\
  2⤵
  PID:1500
- C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
  2⤵
  PID:1644
- - C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
    3⤵
    PID:3020
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
    3⤵
    PID:2820
- C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\
  2⤵
  PID:2272
- C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
  2⤵
  PID:2764
- C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
  2⤵
  PID:2376
- C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
  2⤵
  PID:2012
- C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
  2⤵
  PID:2632

C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\
1⤵
PID:1156

C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
1⤵
PID:2144

C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
1⤵
PID:1720

C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
1⤵
PID:2348

C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
1⤵
PID:2800

C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
1⤵
PID:2020

C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
1⤵
PID:1644

C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
1⤵
PID:992

C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2504

C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
1⤵
PID:1732
- C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
  2⤵
  PID:2820
- - C:\Program Files\Windows Journal\de-DE\backup.exe
    "C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\
    3⤵
    PID:1684

C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
1⤵
PID:2540

C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
1⤵
PID:2552

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
1⤵
PID:2720

C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
1⤵
PID:2956

C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
1⤵
PID:3052

C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
1⤵
PID:1340

C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
1⤵
PID:1796

C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
1⤵
PID:376

C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\
1⤵
PID:1888

C:\Program Files\Windows Defender\de-DE\backup.exe
"C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
1⤵
PID:2280

C:\Program Files\Windows Defender\en-US\backup.exe
"C:\Program Files\Windows Defender\en-US\backup.exe" C:\Program Files\Windows Defender\en-US\
1⤵
PID:3060

C:\Program Files\Windows Defender\es-ES\backup.exe
"C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
1⤵
PID:1336

C:\Program Files\VideoLAN\VLC\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
1⤵
PID:2476
- C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
  2⤵
  PID:1648
- C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
  2⤵
  PID:1128
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
    3⤵
    PID:2204
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
    3⤵
    PID:1292
  - - C:\Program Files (x86)\Common Files\System\ja-JP\System Restore.exe
      "C:\Program Files (x86)\Common Files\System\ja-JP\System Restore.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Common Files\System\msadc\backup.exe
      "C:\Program Files (x86)\Common Files\System\msadc\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\
      4⤵
      PID:876
    - - C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\msadc\de-DE\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1544
- C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
  2⤵
  PID:2916
- C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
  2⤵
  PID:2292
- C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
  2⤵
  PID:1516
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
    3⤵
    PID:2156

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:1576
- C:\Users\Public\backup.exe
  C:\Users\Public\backup.exe C:\Users\Public\
  2⤵
  PID:2876

C:\Program Files\Windows Defender\it-IT\backup.exe
"C:\Program Files\Windows Defender\it-IT\backup.exe" C:\Program Files\Windows Defender\it-IT\
1⤵
PID:2260

C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\modules\
1⤵
PID:2012

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:2820
- C:\Program Files\Windows Journal\en-US\backup.exe
  "C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
  2⤵
  PID:1584
- C:\Program Files\Windows Journal\Templates\backup.exe
  "C:\Program Files\Windows Journal\Templates\backup.exe" C:\Program Files\Windows Journal\Templates\
  2⤵
  PID:1572
- C:\Program Files\Windows Journal\ja-JP\backup.exe
  "C:\Program Files\Windows Journal\ja-JP\backup.exe" C:\Program Files\Windows Journal\ja-JP\
  2⤵
  PID:2172
- C:\Program Files\Windows Journal\it-IT\backup.exe
  "C:\Program Files\Windows Journal\it-IT\backup.exe" C:\Program Files\Windows Journal\it-IT\
  2⤵
  PID:2300
- C:\Program Files\Windows Journal\fr-FR\backup.exe
  "C:\Program Files\Windows Journal\fr-FR\backup.exe" C:\Program Files\Windows Journal\fr-FR\
  2⤵
  PID:3064
- C:\Program Files\Windows Journal\es-ES\backup.exe
  "C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
  2⤵
  PID:1176
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
  2⤵
  PID:1860

C:\Program Files (x86)\Common Files\Services\backup.exe
"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
1⤵
PID:1580

C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
1⤵
PID:2400

C:\Program Files (x86)\Common Files\System\backup.exe
"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
1⤵
PID:1292
- C:\Program Files (x86)\Common Files\System\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\
  2⤵
  PID:2632
- C:\Program Files (x86)\Common Files\System\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\System\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\en-US\
  2⤵
  PID:2944
- - C:\Program Files\Java\jre7\lib\zi\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
    3⤵
    PID:2332
- - C:\Program Files\Java\jre7\lib\management\backup.exe
    "C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
    3⤵
    PID:2028
- - C:\Program Files\Java\jre7\lib\fonts\backup.exe
    "C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\
    3⤵
    PID:2988
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
      4⤵
      PID:2904
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
      4⤵
      PID:2824
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
      4⤵
      PID:3056
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
      4⤵
      PID:2044
- - C:\Program Files\Java\jre7\lib\deploy\backup.exe
    "C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\
    3⤵
    PID:2768
- - C:\Program Files\Java\jre7\lib\cmm\update.exe
    "C:\Program Files\Java\jre7\lib\cmm\update.exe" C:\Program Files\Java\jre7\lib\cmm\
    3⤵
    PID:2900
- - C:\Program Files\Java\jre7\lib\amd64\backup.exe
    "C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
    3⤵
    PID:2784
- C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\
  2⤵
  PID:684
- - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
    3⤵
    PID:1972
- C:\Program Files (x86)\Common Files\System\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\System\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\it-IT\
  2⤵
  PID:2124
- C:\Program Files (x86)\Common Files\System\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\
  2⤵
  PID:2328
- C:\Program Files (x86)\Common Files\System\ado\backup.exe
  "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
  2⤵
  PID:1860

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
1⤵
PID:2892
- C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
  2⤵
  PID:2812
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
    3⤵
    PID:2736
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
    3⤵
    PID:2844

C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
1⤵
PID:2204
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
  2⤵
  PID:2540

C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
1⤵
PID:2188

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\
1⤵
PID:3024

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\
1⤵
PID:2252

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:1884
- C:\Windows\addins\backup.exe
  C:\Windows\addins\backup.exe C:\Windows\addins\
  2⤵
  PID:1740
- C:\Windows\AppCompat\backup.exe
  C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
  2⤵
  PID:2280
- C:\Windows\AppPatch\backup.exe
  C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
  2⤵
  PID:2696
- C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
  2⤵
  PID:2916

C:\Program Files\Windows Media Player\data.exe
"C:\Program Files\Windows Media Player\data.exe" C:\Program Files\Windows Media Player\
1⤵
PID:3020
- C:\Program Files\Windows Media Player\de-DE\backup.exe
  "C:\Program Files\Windows Media Player\de-DE\backup.exe" C:\Program Files\Windows Media Player\de-DE\
  2⤵
  PID:3024
- C:\Program Files\Windows Media Player\en-US\backup.exe
  "C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
  2⤵
  PID:2908

C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\
1⤵
PID:2040

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\
1⤵
PID:2012

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\
1⤵
PID:2616

C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
1⤵
PID:916

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
1⤵
PID:2908

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\
1⤵
PID:2784

C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
1⤵
PID:1780

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
1⤵
PID:2544

C:\Program Files\Windows Mail\backup.exe
"C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\
1⤵
PID:1976

C:\Program Files\VideoLAN\VLC\plugins\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\
1⤵
PID:1348

C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
1⤵
PID:552

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2732

C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
1⤵
PID:2632

C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
1⤵
PID:1812

C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
1⤵
PID:888

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
1⤵
PID:840

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
1⤵
PID:2496

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:1752

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
1⤵
PID:888

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:1748
- C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
  2⤵
  PID:2092
- - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe
    "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\
    3⤵
    PID:2720
  - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe
      "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\
      4⤵
      PID:2636
    - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\
        5⤵
        
        PID:1868
    - - C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\
        5⤵
        
        PID:308

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
1⤵
PID:2292

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
1⤵
PID:2560

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
1⤵
PID:1984
- C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
  2⤵
  PID:2616
- C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\System Restore.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
  2⤵
  PID:2824
- C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
  2⤵
  PID:3056

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\update.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:1624
- C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
  2⤵
  PID:2460
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
    3⤵
    PID:2668
- C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
  2⤵
  PID:2260
- C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
  2⤵
  PID:2860

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:1664

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:2752

C:\Program Files\MSBuild\backup.exe
"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
1⤵
PID:2344

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\System Restore.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\System Restore.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
1⤵
PID:304

C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
"C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
1⤵
PID:1636

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:1380

C:\Program Files\Microsoft Office\backup.exe
"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
1⤵
PID:900

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
1⤵
PID:1052

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\
1⤵
PID:1120

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\
1⤵
PID:1280

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\
1⤵
PID:1680
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
  2⤵
  PID:1348
- - C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d9\
    3⤵
    PID:2300
- - C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\demux\
    3⤵
    PID:880
- - C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\gui\
    3⤵
    PID:2196
- - C:\Program Files\VideoLAN\VLC\plugins\keystore\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\keystore\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\keystore\
    3⤵
    PID:1772
- - C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\logger\
    3⤵
    PID:1856
- - C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe
    "C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\lua\
    3⤵
    PID:1312
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
  2⤵
  PID:2440

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\data.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\data.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
1⤵
PID:2120

C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
1⤵
PID:2576

C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
1⤵
PID:3024

C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
1⤵
PID:2252
- C:\Program Files\Internet Explorer\SIGNUP\backup.exe
  "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
  2⤵
  PID:2492
- C:\Program Files\Internet Explorer\ja-JP\update.exe
  "C:\Program Files\Internet Explorer\ja-JP\update.exe" C:\Program Files\Internet Explorer\ja-JP\
  2⤵
  PID:2228
- - C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
    "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
    3⤵
    PID:2576
- - C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
    "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
    3⤵
    PID:1796
- C:\Program Files\Internet Explorer\it-IT\backup.exe
  "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
  2⤵
  PID:2672
- C:\Program Files\Internet Explorer\images\backup.exe
  "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
  2⤵
  PID:2620
- C:\Program Files\Internet Explorer\es-ES\backup.exe
  "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
  2⤵
  PID:2696
- C:\Program Files\Internet Explorer\en-US\backup.exe
  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
  2⤵
  PID:1648

C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
1⤵
PID:2704
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
  2⤵
  PID:2168
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
  2⤵
  PID:1532
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
  2⤵
  PID:2256
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
  2⤵
  PID:2684
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
  2⤵
  PID:3044
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
  2⤵
  PID:2612
- C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
  2⤵
  PID:2888

C:\Program Files\Microsoft Games\backup.exe
"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
1⤵
PID:2440

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
1⤵
PID:1540

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
1⤵
PID:2356

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
1⤵
PID:1144

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
1⤵
PID:2812

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
1⤵
PID:1516

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
1⤵
PID:2968

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
1⤵
PID:1716

C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
1⤵
PID:1496
- C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
  2⤵
  PID:2120
- C:\Program Files\Common Files\System\ado\it-IT\backup.exe
  "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
  2⤵
  PID:2328
- C:\Program Files\Common Files\System\ado\en-US\System Restore.exe
  "C:\Program Files\Common Files\System\ado\en-US\System Restore.exe" C:\Program Files\Common Files\System\ado\en-US\
  2⤵
  PID:1548

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:1324

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:2252

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
1⤵
PID:2784

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
1⤵
PID:1604

C:\Program Files\Google\Chrome\backup.exe
"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
1⤵
PID:2280
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
  2⤵
  PID:2360
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
  2⤵
  PID:844
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:632

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:2224

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:2344

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2924

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1260

C:\Program Files\backup.exe
"C:\Program Files\backup.exe" C:\Program Files\
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1560

C:\PerfLogs\data.exe
C:\PerfLogs\data.exe C:\PerfLogs\
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1872

C:\backup.exe
\backup.exe \
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
6555095ea83617e92fbcd250ddd331a1

SHA1
3d03ac85a1b6255d4ea02924fd364c2f6d68ab63

SHA256
0b1c15ac53352764890563f32ce5bb7efb9c10505a7b17d84d8c45b5a37edc98

SHA512
9b6694b713e970fe208dba907006ac279d36ca83e1e0f3d2c522e7d88bc498b2659a15461be9857a91818028db12f510a74ceb460b5204374b048b89e03ebfe6

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
72KB

MD5
43d0f6084b29a6f37fa54a56a6b50632

SHA1
5797f6916c787d9df93217cd9fe38092d8fc5637

SHA256
ab9be3572c11653a2db62acaaec1d33f8bcf4e18c61026c0e78a48d16cb81d39

SHA512
649154991332ac7bc724b653f4d9cf24fcb9d57001bc88b70603695a6409707197c5d01e4ceb479fa03481b91109c8a73e1916b3aae1e1564e4aec7dcb64096c

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
0f4a0445f8421c6551f6920e087312de

SHA1
2e1cf2b8e4c65c7ab3394af17b52a1f4e92c5100

SHA256
c1e2ae06d8fdaa416327666c29ef71bc848325ff56697ecac05b66f8c76d4528

SHA512
54c72746c69d0296fbef938ec9dc990aa37aa1575849ebdba48bfd42fdf8f3dc5f82b7592fe0413e59bc560f660b6be3ab960f389be9c501d4c58058a3dbdb2f

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
593fe0e17631c2027b675e1af97d7638

SHA1
b49db60bcc9f9d8dcd603fa4ff85ed9323b48e5b

SHA256
0859de60e48cfc2ad23d370fd896bff031fdbfd1b5e39a985d86efee66d2cbfe

SHA512
d9bfe6b65df4f87bd6a53e2c20906e856f6482c8393d76602570bf6796f14b33123a44c23981fe3c068482abd6973da90d81dada57c86bf5c32363f1b2acb17f

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
05f9818d0a135a1a08014ea582b92b72

SHA1
da35c237e213067eeea53a041b287686ff30875b

SHA256
410707f713f6363f4bfede2d9a179408c087d34549ff669847418d56ed3b409e

SHA512
4eae76b185cb724e7ec4d31e7f03037eea7db346fc28bbcd19d1c08e1affac4206a7a0aed6d802c6af77bb66dd6045511deea27f1480d905afb51efcb93ffa2a

Download Submit
C:\backup.exe

Filesize
72KB

MD5
8ad2531e2ef5d9c2b16677102342a4f9

SHA1
70e978450dec59e8a82e232d1e6cec093f135e9f

SHA256
a14a2d5821cd40be56b8c43755f2055b8c7d1548547aaa2e38d6e34a5665129e

SHA512
09539876201395e8e555c11167004b45f62828fa3f9c84aa10dffe1af7beba0cb83aad9412afc2b4f94df07bf74144e8138b919872ca313ff696296e3db5922f

Download Submit
memory/1780-1783-0x0000000002A80000-0x0000000002B90000-memory.dmp

Filesize
1.1MB

Download
memory/2540-98-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads