7f022cfd2dcd2a1c2d5386240db09212aa2665f7b9cabf2e6cabdc51132f0bb5

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

238808d3c33097a072224a2c25dafe5c.exe
Size

72KB
MD5

238808d3c33097a072224a2c25dafe5c
SHA1

5e34fa402bdb6d470331ca768aa22f807577ba59
SHA256

7f022cfd2dcd2a1c2d5386240db09212aa2665f7b9cabf2e6cabdc51132f0bb5
SHA512

ab5b6a965a69a2f4f450e85021419cfc12968128535aff30714dbfe4a3fe01a1c845a0aa9d50d57e0af76383126e12b86a068b03796d1b5a8881e99ed28ba2e7
SSDEEP

768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRr9DZ:teThavEjDWguK9l

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	238808d3c33097a072224a2c25dafe5c.exe

Executes dropped EXE 9 IoCs

pid	Process
2016	Process not Found
4548	Process not Found
852	Process not Found
4528	Process not Found
4816	Process not Found
4844	Process not Found
392	Process not Found
4488	Process not Found
1124	Process not Found

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4180	238808d3c33097a072224a2c25dafe5c.exe
2016	Process not Found
4548	Process not Found
852	Process not Found
4528	Process not Found
4816	Process not Found
4844	Process not Found
392	Process not Found
4488	Process not Found

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2016	4180	238808d3c33097a072224a2c25dafe5c.exe	2264
PID 4180 wrote to memory of 2016	4180	238808d3c33097a072224a2c25dafe5c.exe	2264
PID 4180 wrote to memory of 2016	4180	238808d3c33097a072224a2c25dafe5c.exe	2264
PID 4180 wrote to memory of 4548	4180	238808d3c33097a072224a2c25dafe5c.exe	2263
PID 4180 wrote to memory of 4548	4180	238808d3c33097a072224a2c25dafe5c.exe	2263
PID 4180 wrote to memory of 4548	4180	238808d3c33097a072224a2c25dafe5c.exe	2263
PID 4180 wrote to memory of 852	4180	238808d3c33097a072224a2c25dafe5c.exe	2385
PID 4180 wrote to memory of 852	4180	238808d3c33097a072224a2c25dafe5c.exe	2385
PID 4180 wrote to memory of 852	4180	238808d3c33097a072224a2c25dafe5c.exe	2385
PID 4180 wrote to memory of 4528	4180	238808d3c33097a072224a2c25dafe5c.exe	2261
PID 4180 wrote to memory of 4528	4180	238808d3c33097a072224a2c25dafe5c.exe	2261
PID 4180 wrote to memory of 4528	4180	238808d3c33097a072224a2c25dafe5c.exe	2261
PID 4180 wrote to memory of 4816	4180	238808d3c33097a072224a2c25dafe5c.exe	2260
PID 4180 wrote to memory of 4816	4180	238808d3c33097a072224a2c25dafe5c.exe	2260
PID 4180 wrote to memory of 4816	4180	238808d3c33097a072224a2c25dafe5c.exe	2260
PID 4180 wrote to memory of 4844	4180	238808d3c33097a072224a2c25dafe5c.exe	2259
PID 4180 wrote to memory of 4844	4180	238808d3c33097a072224a2c25dafe5c.exe	2259
PID 4180 wrote to memory of 4844	4180	238808d3c33097a072224a2c25dafe5c.exe	2259
PID 4180 wrote to memory of 392	4180	238808d3c33097a072224a2c25dafe5c.exe	2257
PID 4180 wrote to memory of 392	4180	238808d3c33097a072224a2c25dafe5c.exe	2257
PID 4180 wrote to memory of 392	4180	238808d3c33097a072224a2c25dafe5c.exe	2257
PID 4180 wrote to memory of 4488	4180	238808d3c33097a072224a2c25dafe5c.exe	2227
PID 4180 wrote to memory of 4488	4180	238808d3c33097a072224a2c25dafe5c.exe	2227
PID 4180 wrote to memory of 4488	4180	238808d3c33097a072224a2c25dafe5c.exe	2227
PID 4180 wrote to memory of 1124	4180	238808d3c33097a072224a2c25dafe5c.exe	2449
PID 4180 wrote to memory of 1124	4180	238808d3c33097a072224a2c25dafe5c.exe	2449
PID 4180 wrote to memory of 1124	4180	238808d3c33097a072224a2c25dafe5c.exe	2449

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	238808d3c33097a072224a2c25dafe5c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	238808d3c33097a072224a2c25dafe5c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Process not Found

C:\Users\Admin\AppData\Local\Temp\238808d3c33097a072224a2c25dafe5c.exe
"C:\Users\Admin\AppData\Local\Temp\238808d3c33097a072224a2c25dafe5c.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4180
- C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
  2⤵
  PID:852
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe
  C:\Users\Admin\AppData\Local\Temp\OneNote\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\
  2⤵
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe
    C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\
    3⤵
    PID:3088

C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\backup.exe C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\
1⤵
PID:1708

C:\PerfLogs\backup.exe
C:\PerfLogs\backup.exe C:\PerfLogs\
1⤵
PID:3752

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
PID:3524

C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
1⤵
PID:1796
- C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe
  "C:\Program Files\Java\jre-1.8\lib\amd64\backup.exe" C:\Program Files\Java\jre-1.8\lib\amd64\
  2⤵
  PID:220
- C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe
  "C:\Program Files\Java\jre-1.8\lib\deploy\backup.exe" C:\Program Files\Java\jre-1.8\lib\deploy\
  2⤵
  PID:1556
- C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe
  "C:\Program Files\Java\jre-1.8\lib\fonts\backup.exe" C:\Program Files\Java\jre-1.8\lib\fonts\
  2⤵
  PID:3588
- C:\Program Files\Java\jre-1.8\lib\ext\System Restore.exe
  "C:\Program Files\Java\jre-1.8\lib\ext\System Restore.exe" C:\Program Files\Java\jre-1.8\lib\ext\
  2⤵
  PID:2332
- C:\Program Files\Java\jre-1.8\lib\security\backup.exe
  "C:\Program Files\Java\jre-1.8\lib\security\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\
  2⤵
  PID:4456

C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
1⤵
PID:2956

C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
1⤵
PID:1000
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\update.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
  2⤵
  PID:2812
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:2996
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\System Restore.exe
    "C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
    3⤵
    PID:3756
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\
    3⤵
    PID:2836
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
  2⤵
  PID:4468
- - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe
    "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\
    3⤵
    PID:2316
  - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\
      4⤵
      PID:3796
    - - C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\
        5⤵
        
        PID:3500
  - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\
      4⤵
      PID:1496
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\
        5⤵
        
        PID:2932
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
        5⤵
        
        PID:2252
      - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\
        6⤵
        
        PID:4692
        
        C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe
        
        C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\backup.exe C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\
        7⤵
        
        PID:2232
  - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\
      4⤵
      PID:3092
  - - C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\backup.exe
      "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\
      4⤵
      PID:1480
    - - C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\
        5⤵
        
        PID:4448
    - - C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\
        5⤵
        
        PID:3348
    - - C:\Program Files\Microsoft Office\Updates\backup.exe
        
        "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
        5⤵
        
        PID:1228
    - - C:\Program Files\Windows Media Player\ja-JP\update.exe
        
        "C:\Program Files\Windows Media Player\ja-JP\update.exe" C:\Program Files\Windows Media Player\ja-JP\
        5⤵
        
        PID:2008
  - - C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\update.exe
      "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\update.exe" C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\
      4⤵
      PID:3856
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
  2⤵
  PID:4108
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
  2⤵
  PID:2652
- C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
  2⤵
  PID:1176

C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
1⤵
PID:444

C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
1⤵
PID:1456

C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
1⤵
PID:4644
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
  2⤵
  PID:1596
- - C:\Windows\addins\backup.exe
    C:\Windows\addins\backup.exe C:\Windows\addins\
    3⤵
    PID:2988
- - C:\Windows\assembly\backup.exe
    C:\Windows\assembly\backup.exe C:\Windows\assembly\
    3⤵
    PID:1800
  - - C:\Windows\assembly\GAC_32\backup.exe
      C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\
      4⤵
      PID:1088
    - - C:\Windows\assembly\GAC_32\PresentationCore\backup.exe
        
        C:\Windows\assembly\GAC_32\PresentationCore\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\
        5⤵
        
        PID:4420
      - C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe
        
        C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\
        6⤵
        
        PID:1976
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{F221DF5D-D0F3-4727-8B68-C46400F33ADF}\backup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{F221DF5D-D0F3-4727-8B68-C46400F33ADF}\backup.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{F221DF5D-D0F3-4727-8B68-C46400F33ADF}\
        7⤵
        
        PID:640
        
        C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:3960
    - - C:\Windows\assembly\GAC_32\System.Data\backup.exe
        
        C:\Windows\assembly\GAC_32\System.Data\backup.exe C:\Windows\assembly\GAC_32\System.Data\
        5⤵
        
        PID:2176
    - - C:\Windows\assembly\GAC_32\System.Transactions\backup.exe
        
        C:\Windows\assembly\GAC_32\System.Transactions\backup.exe C:\Windows\assembly\GAC_32\System.Transactions\
        5⤵
        
        PID:1820
    - - C:\Windows\assembly\GAC_32\System.Web\backup.exe
        
        C:\Windows\assembly\GAC_32\System.Web\backup.exe C:\Windows\assembly\GAC_32\System.Web\
        5⤵
        
        PID:2936
    - - C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\
        5⤵
        
        PID:3236
  - - C:\Windows\assembly\GAC_64\backup.exe
      C:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\
      4⤵
      PID:316
    - - C:\Windows\assembly\GAC_64\PresentationCore\backup.exe
        
        C:\Windows\assembly\GAC_64\PresentationCore\backup.exe C:\Windows\assembly\GAC_64\PresentationCore\
        5⤵
        
        PID:1936
    - - C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe
        
        C:\Windows\assembly\GAC_64\System.Data.OracleClient\backup.exe C:\Windows\assembly\GAC_64\System.Data.OracleClient\
        5⤵
        
        PID:4400
  - - C:\Windows\assembly\NativeImages_v4.0.30319_32\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_32\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\
      4⤵
      PID:640
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\
        5⤵
        
        PID:1976
      - C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\00194bf840ef92b2565b539f29704dc8\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\00194bf840ef92b2565b539f29704dc8\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\00194bf840ef92b2565b539f29704dc8\
        6⤵
        
        PID:1984
      - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\
        6⤵
        
        PID:1628
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\
        5⤵
        
        PID:1792
      - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Abf69f55a#\7153ef0bfdd1efd38882e46b46b7745a\
        6⤵
        
        PID:4220
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\
        5⤵
        
        PID:848
      - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\43665f9aaca15fa115fc03eb3e946324\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\43665f9aaca15fa115fc03eb3e946324\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\43665f9aaca15fa115fc03eb3e946324\
        6⤵
        
        PID:3484
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\
        5⤵
        
        PID:2012
      - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\7710ed46e965bbb56a0558fbff9916f3\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\7710ed46e965bbb56a0558fbff9916f3\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\7710ed46e965bbb56a0558fbff9916f3\
        6⤵
        
        PID:1756
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\
        5⤵
        
        PID:4544
      - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\07760e3f77c2cd8ca7cfce131f86da95\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\07760e3f77c2cd8ca7cfce131f86da95\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\07760e3f77c2cd8ca7cfce131f86da95\
        6⤵
        
        PID:1736
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\
        7⤵
        
        PID:912
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\System\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\System\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\
        7⤵
        
        PID:1608
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\
        5⤵
        
        PID:1536
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\
        5⤵
        
        PID:3272
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\
        5⤵
        
        PID:984
      - C:\Windows\INF\ESENT\0C0A\backup.exe
        
        C:\Windows\INF\ESENT\0C0A\backup.exe C:\Windows\INF\ESENT\0C0A\
        6⤵
        
        PID:732
      - C:\Windows\INF\ESENT\0410\backup.exe
        
        C:\Windows\INF\ESENT\0410\backup.exe C:\Windows\INF\ESENT\0410\
        6⤵
        
        PID:536
      - C:\Windows\INF\ESENT\0409\backup.exe
        
        C:\Windows\INF\ESENT\0409\backup.exe C:\Windows\INF\ESENT\0409\
        6⤵
        
        PID:4460
      - C:\Windows\INF\ESENT\0407\backup.exe
        
        C:\Windows\INF\ESENT\0407\backup.exe C:\Windows\INF\ESENT\0407\
        6⤵
        
        PID:2664
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\
        5⤵
        
        PID:2912
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\
        5⤵
        
        PID:5012
      - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\c22867030e5bfe64cd2f01ea2a121306\data.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\c22867030e5bfe64cd2f01ea2a121306\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\c22867030e5bfe64cd2f01ea2a121306\
        6⤵
        
        PID:2912
      - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\
        6⤵
        
        PID:2428
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\
        5⤵
        
        PID:956
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\
        5⤵
        
        PID:2804
      - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\
        6⤵
        
        PID:2684
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\
        5⤵
        
        PID:1028
      - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\e973d5bd29c030458489be8e83909001\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\e973d5bd29c030458489be8e83909001\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\e973d5bd29c030458489be8e83909001\
        6⤵
        
        PID:2144
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\
        5⤵
        
        PID:3068
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb#\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb#\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb#\
        5⤵
        
        PID:4872
    - - C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\
        5⤵
        
        PID:4720
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\
      4⤵
      PID:512
  - - C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_64\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\
      4⤵
      PID:3572
- - C:\Windows\Branding\backup.exe
    C:\Windows\Branding\backup.exe C:\Windows\Branding\
    3⤵
    PID:4132
- - C:\Windows\debug\backup.exe
    C:\Windows\debug\backup.exe C:\Windows\debug\
    3⤵
    PID:2304
- - C:\Windows\de-DE\backup.exe
    C:\Windows\de-DE\backup.exe C:\Windows\de-DE\
    3⤵
    PID:752
- - C:\Windows\DiagTrack\backup.exe
    C:\Windows\DiagTrack\backup.exe C:\Windows\DiagTrack\
    3⤵
    PID:748
  - - C:\Windows\DiagTrack\Scenarios\backup.exe
      C:\Windows\DiagTrack\Scenarios\backup.exe C:\Windows\DiagTrack\Scenarios\
      4⤵
      PID:2440
- - C:\Windows\en-US\backup.exe
    C:\Windows\en-US\backup.exe C:\Windows\en-US\
    3⤵
    PID:2008
- - C:\Windows\es-ES\backup.exe
    C:\Windows\es-ES\backup.exe C:\Windows\es-ES\
    3⤵
    PID:4112
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\backup.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\
      4⤵
      PID:1736
    - - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\
        5⤵
        
        PID:3532
      - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\
        6⤵
        
        PID:1896
        
        C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\data.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\data.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\
        7⤵
        
        PID:4400
        
        C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\data.exe
        
        C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\
        8⤵
        
        PID:3348
- - C:\Windows\fr-FR\backup.exe
    C:\Windows\fr-FR\backup.exe C:\Windows\fr-FR\
    3⤵
    PID:3796
- - C:\Windows\Globalization\backup.exe
    C:\Windows\Globalization\backup.exe C:\Windows\Globalization\
    3⤵
    PID:1144
  - - C:\Windows\Globalization\ELS\backup.exe
      C:\Windows\Globalization\ELS\backup.exe C:\Windows\Globalization\ELS\
      4⤵
      PID:2428
    - - C:\Windows\Globalization\ELS\Transliteration\backup.exe
        
        C:\Windows\Globalization\ELS\Transliteration\backup.exe C:\Windows\Globalization\ELS\Transliteration\
        5⤵
        
        PID:5076
  - - C:\Windows\Globalization\ICU\backup.exe
      C:\Windows\Globalization\ICU\backup.exe C:\Windows\Globalization\ICU\
      4⤵
      PID:1476
  - - C:\Windows\Globalization\Time Zone\backup.exe
      "C:\Windows\Globalization\Time Zone\backup.exe" C:\Windows\Globalization\Time Zone\
      4⤵
      PID:4892
  - - C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
      4⤵
      PID:4356
    - - C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
        5⤵
        
        PID:2704
- - C:\Windows\IME\backup.exe
    C:\Windows\IME\backup.exe C:\Windows\IME\
    3⤵
    PID:4456
  - - C:\Windows\IME\de-DE\backup.exe
      C:\Windows\IME\de-DE\backup.exe C:\Windows\IME\de-DE\
      4⤵
      PID:3180
  - - C:\Windows\IME\en-US\backup.exe
      C:\Windows\IME\en-US\backup.exe C:\Windows\IME\en-US\
      4⤵
      PID:2828
  - - C:\Windows\IME\IMETC\update.exe
      C:\Windows\IME\IMETC\update.exe C:\Windows\IME\IMETC\
      4⤵
      PID:3108
    - - C:\Windows\IME\IMETC\DICTS\backup.exe
        
        C:\Windows\IME\IMETC\DICTS\backup.exe C:\Windows\IME\IMETC\DICTS\
        5⤵
        
        PID:4424
    - - C:\Windows\IME\IMETC\HELP\backup.exe
        
        C:\Windows\IME\IMETC\HELP\backup.exe C:\Windows\IME\IMETC\HELP\
        5⤵
        
        PID:4208
  - - C:\Windows\IME\it-IT\backup.exe
      C:\Windows\IME\it-IT\backup.exe C:\Windows\IME\it-IT\
      4⤵
      PID:640
  - - C:\Windows\IME\ja-JP\backup.exe
      C:\Windows\IME\ja-JP\backup.exe C:\Windows\IME\ja-JP\
      4⤵
      PID:4332
    - - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\
        5⤵
        
        PID:432
- - C:\Windows\ImmersiveControlPanel\backup.exe
    C:\Windows\ImmersiveControlPanel\backup.exe C:\Windows\ImmersiveControlPanel\
    3⤵
    PID:4108
  - - C:\Windows\ImmersiveControlPanel\images\backup.exe
      C:\Windows\ImmersiveControlPanel\images\backup.exe C:\Windows\ImmersiveControlPanel\images\
      4⤵
      PID:1632
  - - C:\Windows\assembly\NativeImages_v2.0.50727_64\System\a67e70d6e6bdcf4ac31a986148d455c4\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_64\System\a67e70d6e6bdcf4ac31a986148d455c4\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\System\a67e70d6e6bdcf4ac31a986148d455c4\
      4⤵
      PID:3348
- - C:\Windows\InputMethod\backup.exe
    C:\Windows\InputMethod\backup.exe C:\Windows\InputMethod\
    3⤵
    PID:1632
  - - C:\Windows\InputMethod\CHS\data.exe
      C:\Windows\InputMethod\CHS\data.exe C:\Windows\InputMethod\CHS\
      4⤵
      PID:1984
  - - C:\Windows\InputMethod\CHT\backup.exe
      C:\Windows\InputMethod\CHT\backup.exe C:\Windows\InputMethod\CHT\
      4⤵
      PID:4692
  - - C:\Windows\InputMethod\SHARED\backup.exe
      C:\Windows\InputMethod\SHARED\backup.exe C:\Windows\InputMethod\SHARED\
      4⤵
      PID:2724
- - C:\Windows\it-IT\backup.exe
    C:\Windows\it-IT\backup.exe C:\Windows\it-IT\
    3⤵
    PID:1756
- - C:\Windows\ja-JP\backup.exe
    C:\Windows\ja-JP\backup.exe C:\Windows\ja-JP\
    3⤵
    PID:220
- - C:\Windows\L2Schemas\System Restore.exe
    "C:\Windows\L2Schemas\System Restore.exe" C:\Windows\L2Schemas\
    3⤵
    PID:4468
- - C:\Windows\LiveKernelReports\backup.exe
    C:\Windows\LiveKernelReports\backup.exe C:\Windows\LiveKernelReports\
    3⤵
    PID:1056
  - - C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
      4⤵
      PID:1144
- - C:\Windows\Logs\backup.exe
    C:\Windows\Logs\backup.exe C:\Windows\Logs\
    3⤵
    PID:732
  - - C:\Windows\Logs\CBS\backup.exe
      C:\Windows\Logs\CBS\backup.exe C:\Windows\Logs\CBS\
      4⤵
      PID:3100
    - - C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
        5⤵
        
        PID:208
  - - C:\Windows\Logs\DPX\backup.exe
      C:\Windows\Logs\DPX\backup.exe C:\Windows\Logs\DPX\
      4⤵
      PID:2188
  - - C:\Windows\Logs\MoSetup\backup.exe
      C:\Windows\Logs\MoSetup\backup.exe C:\Windows\Logs\MoSetup\
      4⤵
      PID:2604
  - - C:\Windows\Logs\NetSetup\backup.exe
      C:\Windows\Logs\NetSetup\backup.exe C:\Windows\Logs\NetSetup\
      4⤵
      PID:5032
  - - C:\Windows\Logs\HomeGroup\backup.exe
      C:\Windows\Logs\HomeGroup\backup.exe C:\Windows\Logs\HomeGroup\
      4⤵
      PID:4816
  - - C:\Windows\Logs\DISM\backup.exe
      C:\Windows\Logs\DISM\backup.exe C:\Windows\Logs\DISM\
      4⤵
      PID:464
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\
        5⤵
        
        PID:1944
  - - C:\Windows\Logs\SettingSync\backup.exe
      C:\Windows\Logs\SettingSync\backup.exe C:\Windows\Logs\SettingSync\
      4⤵
      PID:848
- - C:\Windows\INF\backup.exe
    C:\Windows\INF\backup.exe C:\Windows\INF\
    3⤵
    PID:1508

C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
1⤵
PID:3052

C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
1⤵
PID:2900

C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
1⤵
PID:3616

C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
1⤵
PID:4032

C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
1⤵
PID:1124

C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
1⤵
PID:4880
- C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
  2⤵
  PID:4808

C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
1⤵
PID:1660

C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
1⤵
PID:3092

C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
1⤵
PID:3104

C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
1⤵
PID:4984

C:\Program Files\Common Files\microsoft shared\MSInfo\update.exe
"C:\Program Files\Common Files\microsoft shared\MSInfo\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
1⤵
PID:4064
- C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\System Restore.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
  2⤵
  PID:4456
- C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
  2⤵
  PID:4216
- C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
  2⤵
  PID:1944
- C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
  2⤵
  PID:2180
- C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
  2⤵
  PID:2988

C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
1⤵
PID:4948
- C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
  "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
  2⤵
  PID:2800

C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:1144
- C:\Program Files\dotnet\shared\Microsoft.NETCore.App\data.exe
  "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\data.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\
  2⤵
  PID:3244
- - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System Restore.exe
    "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System Restore.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\
    3⤵
    PID:1980
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\
      4⤵
      PID:2176
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\update.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\
      4⤵
      PID:1552
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\
        5⤵
        
        PID:4752
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\
      4⤵
      PID:3100
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\
      4⤵
      PID:4948
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\
      4⤵
      PID:1372
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\
        5⤵
        
        PID:3200
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\
        5⤵
        
        PID:2984
    - - C:\Windows\appcompat\appraiser\backup.exe
        
        C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
        5⤵
        
        PID:1620
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
        6⤵
        
        PID:1508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\
        7⤵
        
        PID:2912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\
        7⤵
        
        PID:3872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\
        7⤵
        
        PID:4104
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\System Restore.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\
        6⤵
        
        PID:3784
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\swiftshader\
        6⤵
        
        PID:1480
        
        C:\Windows\Help\Help\backup.exe
        
        C:\Windows\Help\Help\backup.exe C:\Windows\Help\Help\
        7⤵
        
        PID:4984
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\update.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\update.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\
        6⤵
        
        PID:2480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\
        7⤵
        
        PID:2880
        
        C:\Program Files\WindowsPowerShell\Modules\PSReadline\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\PSReadline\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\
        8⤵
        
        PID:1628
        
        C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\
        8⤵
        
        PID:2708
        
        C:\Program Files\WindowsPowerShell\Modules\Pester\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\Pester\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\
        8⤵
        
        PID:2696
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\update.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\update.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\
        6⤵
        
        PID:732
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\
        6⤵
        
        PID:1736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\backup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\
        7⤵
        
        PID:4596
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\
        7⤵
        
        PID:2900
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\
        7⤵
        
        PID:5036
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\0c596f320c82d9ea5d0b5a6362a0750a\
        8⤵
        
        PID:1240
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\
        7⤵
        
        PID:2604
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\srmlib\e7a3b638f7646fc8439936218d34b2b7\
        8⤵
        
        PID:4544
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\
        7⤵
        
        PID:5084
    - - C:\Windows\appcompat\Programs\backup.exe
        
        C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
        5⤵
        
        PID:4648
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\
      4⤵
      PID:1564
- - C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\data.exe
    "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\data.exe" C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\
    3⤵
    PID:432

C:\Program Files\Common Files\microsoft shared\Source Engine\data.exe
"C:\Program Files\Common Files\microsoft shared\Source Engine\data.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
1⤵
PID:1708

C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
1⤵
PID:1440

C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
1⤵
PID:908

C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
1⤵
PID:3496

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
1⤵
PID:1176
- C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
  "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
  2⤵
  PID:2304
- - C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe
    "C:\Program Files\Java\jdk-1.8\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk-1.8\include\win32\bridge\
    3⤵
    PID:4376

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:444

C:\Program Files\Common Files\System\backup.exe
"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
1⤵
PID:452
- C:\Program Files\Common Files\System\ado\backup.exe
  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
  2⤵
  PID:3460
- - C:\Program Files\Common Files\System\ado\de-DE\backup.exe
    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
    3⤵
    PID:3236
- - C:\Program Files\Common Files\System\ado\es-ES\backup.exe
    "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
    3⤵
    PID:3052
- - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
    3⤵
    PID:536
  - - C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\
      4⤵
      PID:3272
    - - C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\
        5⤵
        
        PID:3280
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
      4⤵
      PID:3176
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\
        5⤵
        
        PID:1704
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\
        6⤵
        
        PID:4052
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\
        7⤵
        
        PID:3796
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\
        8⤵
        
        PID:4696
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\
        7⤵
        
        PID:4216
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\
        7⤵
        
        PID:4860
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\
        8⤵
        
        PID:4528
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\
        9⤵
        
        PID:1744
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\
        7⤵
        
        PID:1240
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\
        8⤵
        
        PID:1552
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\
        8⤵
        
        PID:4216
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\
        7⤵
        
        PID:3744
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\
        7⤵
        
        PID:2356
- - C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:1896
  - - C:\Windows\Help\OEM\ContentStore\backup.exe
      C:\Windows\Help\OEM\ContentStore\backup.exe C:\Windows\Help\OEM\ContentStore\
      4⤵
      PID:364
- C:\Program Files\Common Files\System\de-DE\backup.exe
  "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
  2⤵
  PID:1088
- C:\Program Files\Common Files\System\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
  2⤵
  PID:2976
- C:\Program Files\Common Files\System\it-IT\backup.exe
  "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
  2⤵
  PID:2832
- C:\Program Files\Common Files\System\Ole DB\data.exe
  "C:\Program Files\Common Files\System\Ole DB\data.exe" C:\Program Files\Common Files\System\Ole DB\
  2⤵
  PID:1920
- - C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
    3⤵
    PID:1456
  - - C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\
      4⤵
      PID:2232
    - - C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\
        5⤵
        
        PID:3924
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\
        5⤵
        
        PID:5040
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\
        6⤵
        
        PID:1564
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\
        6⤵
        
        PID:2856
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\
        6⤵
        
        PID:3408
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\
        7⤵
        
        PID:2956
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\
        6⤵
        
        PID:1660
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\
        6⤵
        
        PID:2392
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\
        6⤵
        
        PID:4176
        
        C:\Users\Admin\Documents\OneNote Notebooks\backup.exe
        
        "C:\Users\Admin\Documents\OneNote Notebooks\backup.exe" C:\Users\Admin\Documents\OneNote Notebooks\
        7⤵
        
        PID:3644
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\
        7⤵
        
        PID:4844
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\
        8⤵
        
        PID:4660
        
        C:\Windows\assembly\GAC\ADODB\backup.exe
        
        C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
        9⤵
        
        PID:3236
        
        C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe
        
        C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\
        9⤵
        
        PID:4908
        
        C:\Windows\Branding\Basebrd\de-DE\backup.exe
        
        C:\Windows\Branding\Basebrd\de-DE\backup.exe C:\Windows\Branding\Basebrd\de-DE\
        10⤵
        
        PID:4064
        
        C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\13.0.0.0__89845DCD8080CC91\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\13.0.0.0__89845DCD8080CC91\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\13.0.0.0__89845DCD8080CC91\
        11⤵
        
        PID:1884
        
        C:\Windows\Branding\Basebrd\es-ES\backup.exe
        
        C:\Windows\Branding\Basebrd\es-ES\backup.exe C:\Windows\Branding\Basebrd\es-ES\
        10⤵
        
        PID:4112
        
        C:\Windows\Branding\Basebrd\it-IT\backup.exe
        
        C:\Windows\Branding\Basebrd\it-IT\backup.exe C:\Windows\Branding\Basebrd\it-IT\
        10⤵
        
        PID:4808
        
        C:\Windows\Branding\Basebrd\ja-JP\backup.exe
        
        C:\Windows\Branding\Basebrd\ja-JP\backup.exe C:\Windows\Branding\Basebrd\ja-JP\
        10⤵
        
        PID:864
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\
        8⤵
        
        PID:2512
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\
        8⤵
        
        PID:4644
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\update.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\
        8⤵
        
        PID:1240
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\
        8⤵
        
        PID:4464
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\update.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\update.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\
        8⤵
        
        PID:4908
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\
        8⤵
        
        PID:1756
        
        C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
        9⤵
        
        PID:848
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\
        8⤵
        
        PID:1736
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\
        8⤵
        
        PID:4948
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\
        8⤵
        
        PID:396
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\
        8⤵
        
        PID:4328
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\
        9⤵
        
        PID:4544
        
        C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\
        10⤵
        
        PID:4328
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\
        8⤵
        
        PID:3200
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\
        7⤵
        
        PID:4108
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\
        7⤵
        
        PID:2572
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\
        7⤵
        
        PID:3272
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\data.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\
        7⤵
        
        PID:2428
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\
        7⤵
        
        PID:3100
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\
        7⤵
        
        PID:1604
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\data.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\
        7⤵
        
        PID:4720
        
        C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\
        8⤵
        
        PID:1200
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\EventViewer\c4e350255dfdcb7457109e297b572b31\
        8⤵
        
        PID:560
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\
        7⤵
        
        PID:3616
        
        C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Core\03132a9da4bc41635b437fe343a37477\backup.exe
        
        C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Core\03132a9da4bc41635b437fe343a37477\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Core\03132a9da4bc41635b437fe343a37477\
        7⤵
        
        PID:1552
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\
        6⤵
        
        PID:1608
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\
        6⤵
        
        PID:4984
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\
        6⤵
        
        PID:3920
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\
        6⤵
        
        PID:3420
  - - C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\3082\backup.exe" C:\Program Files\Microsoft Office\root\Office16\3082\
      4⤵
      PID:3784
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\
        5⤵
        
        PID:1344
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\
        6⤵
        
        PID:4064
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ar-ae\
        7⤵
        
        PID:4604
        
        C:\Program Files\Windows Defender\es-ES\backup.exe
        
        "C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
        8⤵
        
        PID:3108
        
        C:\Program Files\Windows Defender\fr-FR\backup.exe
        
        "C:\Program Files\Windows Defender\fr-FR\backup.exe" C:\Program Files\Windows Defender\fr-FR\
        8⤵
        
        PID:2176
        
        C:\Program Files\Windows Defender\ja-JP\backup.exe
        
        "C:\Program Files\Windows Defender\ja-JP\backup.exe" C:\Program Files\Windows Defender\ja-JP\
        8⤵
        
        PID:1288
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\
        9⤵
        
        PID:2664
        
        C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\
        10⤵
        
        PID:3784
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\
        9⤵
        
        PID:2800
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\
        9⤵
        
        PID:3308
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\
        9⤵
        
        PID:2960
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\data.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\
        9⤵
        
        PID:3308
        
        C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
        10⤵
        
        PID:1976
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\
        9⤵
        
        PID:3100
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\
        9⤵
        
        PID:396
        
        C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\backup.exe
        
        C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\
        10⤵
        
        PID:5076
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\
        9⤵
        
        PID:2684
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\
        9⤵
        
        PID:864
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\
        9⤵
        
        PID:4692
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\
        7⤵
        
        PID:1308
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\
        8⤵
        
        PID:4464
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\
        7⤵
        
        PID:4448
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\
        7⤵
        
        PID:2052
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\
        7⤵
        
        PID:640
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\
        7⤵
        
        PID:1068
        
        C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\
        8⤵
        
        PID:2832
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\
        7⤵
        
        PID:2144
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\
        7⤵
        
        PID:4304
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\
        7⤵
        
        PID:3644
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\
        7⤵
        
        PID:2956
  - - C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\BORDERS\backup.exe" C:\Program Files\Microsoft Office\root\Office16\BORDERS\
      4⤵
      PID:4468
  - - C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\Document Parts\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\
      4⤵
      PID:1148
    - - C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\
        5⤵
        
        PID:4456
      - C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\
        6⤵
        
        PID:1088
  - - C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\FPA_f2\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f2\
      4⤵
      PID:2252
  - - C:\Program Files\Microsoft Office\root\Office16\FPA_f33\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\FPA_f33\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_f33\
      4⤵
      PID:1660
  - - C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\backup.exe" C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\
      4⤵
      PID:3612
  - - C:\Program Files\Microsoft Office\root\Office16\MEDIA\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MEDIA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MEDIA\
      4⤵
      PID:2976
  - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\MSIPC\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\
      4⤵
      PID:4796
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\data.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\data.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\
        5⤵
        
        PID:1608
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\
        5⤵
        
        PID:3360
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\
        5⤵
        
        PID:1356
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\update.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\update.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\
        5⤵
        
        PID:3920
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\
        5⤵
        
        PID:864
      - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System Restore.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
        6⤵
        
        PID:1620
      - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
        6⤵
        
        PID:1240
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\
        5⤵
        
        PID:1508
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\
        5⤵
        
        PID:2932
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\
        5⤵
        
        PID:4376
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\
        5⤵
        
        PID:4800
      - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
        
        C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
        6⤵
        
        PID:3212
      - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\data.exe
        
        C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\
        6⤵
        
        PID:3824
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\
        5⤵
        
        PID:2988
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\
        5⤵
        
        PID:1944
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\
        5⤵
        
        PID:4104
    - - C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\backup.exe
        
        "C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\backup.exe" C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\
        5⤵
        
        PID:888
      - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\System Restore.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\System Restore.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\
        6⤵
        
        PID:3968
    - - C:\Windows\IME\IMEKR\DICTS\backup.exe
        
        C:\Windows\IME\IMEKR\DICTS\backup.exe C:\Windows\IME\IMEKR\DICTS\
        5⤵
        
        PID:3744
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\
        6⤵
        
        PID:4112
        
        C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\
        7⤵
        
        PID:1516
        
        C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\
        7⤵
        
        PID:3320
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\
        6⤵
        
        PID:4832
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\
        7⤵
        
        PID:3484
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\
        8⤵
        
        PID:1056
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\
        6⤵
        
        PID:3712
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\
        7⤵
        
        PID:4328
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ar-ae\
        8⤵
        
        PID:4500
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\
        8⤵
        
        PID:3236
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\
        8⤵
        
        PID:4588
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\
        8⤵
        
        PID:3648
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\
        8⤵
        
        PID:5108
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\
        8⤵
        
        PID:3336
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\
        8⤵
        
        PID:1912
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\
        8⤵
        
        PID:2988
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\data.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\
        8⤵
        
        PID:1792
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\
        8⤵
        
        PID:2912
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\
        8⤵
        
        PID:3752
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\
        8⤵
        
        PID:3640
    - - C:\Windows\IME\IMEKR\HELP\backup.exe
        
        C:\Windows\IME\IMEKR\HELP\backup.exe C:\Windows\IME\IMEKR\HELP\
        5⤵
        
        PID:3488
    - - C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
        5⤵
        
        PID:324
  - - C:\Program Files\Microsoft Office\root\Office16\OneNote\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\OneNote\backup.exe" C:\Program Files\Microsoft Office\root\Office16\OneNote\
      4⤵
      PID:2612
  - - C:\Program Files\Microsoft Office\root\Office16\osfFPA\backup.exe
      "C:\Program Files\Microsoft Office\root\Office16\osfFPA\backup.exe" C:\Program Files\Microsoft Office\root\Office16\osfFPA\
      4⤵
      PID:4112
- - C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
    3⤵
    PID:4560
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4036

C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
1⤵
PID:4752
- C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe
  "C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\backup.exe" C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\
  2⤵
  PID:4232

C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
1⤵
PID:1896

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
1⤵
PID:4900

C:\Program Files\dotnet\backup.exe
"C:\Program Files\dotnet\backup.exe" C:\Program Files\dotnet\
1⤵
PID:4596
- C:\Program Files\dotnet\swidtag\update.exe
  "C:\Program Files\dotnet\swidtag\update.exe" C:\Program Files\dotnet\swidtag\
  2⤵
  PID:1200
- C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe
  "C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\backup.exe" C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\
  2⤵
  PID:1468
- C:\Program Files\Windows NT\Accessories\en-US\backup.exe
  "C:\Program Files\Windows NT\Accessories\en-US\backup.exe" C:\Program Files\Windows NT\Accessories\en-US\
  2⤵
  PID:1936

C:\Program Files\dotnet\host\fxr\backup.exe
"C:\Program Files\dotnet\host\fxr\backup.exe" C:\Program Files\dotnet\host\fxr\
1⤵
PID:2216
- C:\Program Files\dotnet\host\fxr\8.0.0\backup.exe
  "C:\Program Files\dotnet\host\fxr\8.0.0\backup.exe" C:\Program Files\dotnet\host\fxr\8.0.0\
  2⤵
  PID:2332

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\
1⤵
PID:3436
- C:\Program Files (x86)\Microsoft.NET\RedistList\update.exe
  "C:\Program Files (x86)\Microsoft.NET\RedistList\update.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\
  2⤵
  PID:2348
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2856
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\update.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:3580

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\
1⤵
PID:1464

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\update.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\update.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\
1⤵
PID:1356

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\
1⤵
PID:1660

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\backup.exe
"C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\backup.exe" C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\
1⤵
PID:2764

C:\Program Files\Google\data.exe
"C:\Program Files\Google\data.exe" C:\Program Files\Google\
1⤵
PID:1536
- C:\Program Files\Google\Chrome\backup.exe
  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
  2⤵
  PID:4176
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
  2⤵
  PID:4680
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\bfdaea28d1c61b8d6ebb102bbf468c49\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\bfdaea28d1c61b8d6ebb102bbf468c49\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\bfdaea28d1c61b8d6ebb102bbf468c49\
  2⤵
  PID:3784

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
1⤵
PID:4900
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
  2⤵
  PID:1208
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
    3⤵
    PID:888
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
      4⤵
      PID:4948
- C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe
  "C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\
  2⤵
  PID:1896

C:\Program Files\Internet Explorer\de-DE\backup.exe
"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:752

C:\Program Files\Internet Explorer\en-US\backup.exe
"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
1⤵
PID:2760

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:1272
- C:\Program Files\Java\jdk-1.8\backup.exe
  "C:\Program Files\Java\jdk-1.8\backup.exe" C:\Program Files\Java\jdk-1.8\
  2⤵
  PID:1976
- - C:\Program Files\Java\jdk-1.8\bin\backup.exe
    "C:\Program Files\Java\jdk-1.8\bin\backup.exe" C:\Program Files\Java\jdk-1.8\bin\
    3⤵
    PID:1720
- - C:\Program Files\Java\jdk-1.8\include\backup.exe
    "C:\Program Files\Java\jdk-1.8\include\backup.exe" C:\Program Files\Java\jdk-1.8\include\
    3⤵
    PID:2080
- - C:\Program Files\Java\jdk-1.8\legal\backup.exe
    "C:\Program Files\Java\jdk-1.8\legal\backup.exe" C:\Program Files\Java\jdk-1.8\legal\
    3⤵
    PID:2240
- - C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\backup.exe" C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\
    3⤵
    PID:1744
- C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_output\
  2⤵
  PID:4908
- C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\gui\
  2⤵
  PID:1744
- C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\logger\
  2⤵
  PID:3968
- C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\misc\
  2⤵
  PID:4860
- C:\Program Files\VideoLAN\VLC\plugins\mux\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\mux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\mux\
  2⤵
  PID:4812
- C:\Program Files\VideoLAN\VLC\plugins\services_discovery\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\services_discovery\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\services_discovery\
  2⤵
  PID:3612
- - C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\
    3⤵
    PID:2564
  - - C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\
      4⤵
      PID:2052
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\backup.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\
      4⤵
      PID:3612
    - - C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\
        5⤵
        
        PID:1548
      - C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\data.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\data.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\
        6⤵
        
        PID:3296
    - - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\
        5⤵
        
        PID:4332
    - - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\
        5⤵
        
        PID:3624
- C:\Program Files\VideoLAN\VLC\plugins\stream_out\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\stream_out\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\stream_out\
  2⤵
  PID:3752
- C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\video_chroma\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_chroma\
  2⤵
  PID:2936
- C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\video_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_filter\
  2⤵
  PID:3572
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\
    3⤵
    PID:1544
  - - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\
      4⤵
      PID:1388
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\
    3⤵
    PID:3308
  - - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\
      4⤵
      PID:4208
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\
    3⤵
    PID:2856
  - - C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\95ce4e7117457677f847d9f26c3bdf0b\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\95ce4e7117457677f847d9f26c3bdf0b\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\95ce4e7117457677f847d9f26c3bdf0b\
      4⤵
      PID:3484
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\
    3⤵
    PID:5044
  - - C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\
      4⤵
      PID:2788
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\
    3⤵
    PID:2368
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Core\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Core\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Core\
    3⤵
    PID:4176
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\System\update.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\System\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\System\
    3⤵
    PID:4108
  - - C:\Windows\ImmersiveControlPanel\SystemSettings\backup.exe
      C:\Windows\ImmersiveControlPanel\SystemSettings\backup.exe C:\Windows\ImmersiveControlPanel\SystemSettings\
      4⤵
      PID:3852
  - - C:\Windows\ImmersiveControlPanel\Settings\backup.exe
      C:\Windows\ImmersiveControlPanel\Settings\backup.exe C:\Windows\ImmersiveControlPanel\Settings\
      4⤵
      PID:1256
  - - C:\Windows\ImmersiveControlPanel\pris\backup.exe
      C:\Windows\ImmersiveControlPanel\pris\backup.exe C:\Windows\ImmersiveControlPanel\pris\
      4⤵
      PID:3792
  - - C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
      4⤵
      PID:4128
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\
    3⤵
    PID:3752
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\
    3⤵
    PID:3632
- - C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\
    3⤵
    PID:4068
- C:\Program Files\VideoLAN\VLC\plugins\video_output\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\video_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_output\
  2⤵
  PID:1944
- - C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
    3⤵
    PID:2076
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\
      4⤵
      PID:628
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\update.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\
      4⤵
      PID:1288
    - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\
        5⤵
        
        PID:512
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\
      4⤵
      PID:1508
    - - C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
        5⤵
        
        PID:2708
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\
      4⤵
      PID:116
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\he-il\
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\
      4⤵
      PID:524
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\data.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\
      4⤵
      PID:4368
- C:\Program Files\VideoLAN\VLC\plugins\video_splitter\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\video_splitter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\video_splitter\
  2⤵
  PID:1980
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\
    3⤵
    PID:1728
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\
    3⤵
    PID:1120
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\
    3⤵
    PID:4064
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\
    3⤵
    PID:4664
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\
    3⤵
    PID:2944
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\
    3⤵
    PID:4068

C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\legal\backup.exe" C:\Program Files\Java\jdk-1.8\jre\legal\
1⤵
PID:4984

C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\amd64\
1⤵
PID:2216

C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\cmm\
1⤵
PID:220

C:\Program Files\Java\jdk-1.8\jre\lib\deploy\System Restore.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\deploy\System Restore.exe" C:\Program Files\Java\jdk-1.8\jre\lib\deploy\
1⤵
PID:2832

C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\ext\
1⤵
PID:3852
- C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
  2⤵
  PID:4528
- - C:\Windows\DigitalLocker\en-US\backup.exe
    C:\Windows\DigitalLocker\en-US\backup.exe C:\Windows\DigitalLocker\en-US\
    3⤵
    PID:4948

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\
1⤵
PID:432
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\
  2⤵
  PID:1744
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\System Restore.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\System Restore.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\
    3⤵
    PID:4660
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\586ed23cb27e69e90eee6d49206356b8\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\586ed23cb27e69e90eee6d49206356b8\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\586ed23cb27e69e90eee6d49206356b8\
      4⤵
      PID:3036
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\
    3⤵
    PID:4628
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\
    3⤵
    PID:512
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\
      4⤵
      PID:3720
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\update.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\update.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\
      4⤵
      PID:1564
    - - C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\
        5⤵
        
        PID:1544
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\data.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\data.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\
      4⤵
      PID:4100
  - - C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\
      4⤵
      PID:4660
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\
    3⤵
    PID:444
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\System Restore.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\System Restore.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\
    3⤵
    PID:1660
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\backup.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\
      4⤵
      PID:4220
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\backup.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\
      4⤵
      PID:2612
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\
      4⤵
      PID:3960
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\backup.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\
      4⤵
      PID:2184
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\backup.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\
      4⤵
      PID:1068
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\update.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\update.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\
      4⤵
      PID:1164
    - - C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\
        5⤵
        
        PID:1980
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\
    3⤵
    PID:1980
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\
    3⤵
    PID:2320
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\
    3⤵
    PID:4488
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\
  2⤵
  PID:1176
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\
  2⤵
  PID:4596
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\
  2⤵
  PID:5104
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\
  2⤵
  PID:3312
- C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\
  2⤵
  PID:3756

C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\jfr\
1⤵
PID:1556

C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe
"C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\
1⤵
PID:624
- C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe
  "C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\
  2⤵
  PID:1144

C:\Program Files\Java\jre-1.8\bin\update.exe
"C:\Program Files\Java\jre-1.8\bin\update.exe" C:\Program Files\Java\jre-1.8\bin\
1⤵
PID:4580
- C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jre-1.8\bin\dtplugin\backup.exe" C:\Program Files\Java\jre-1.8\bin\dtplugin\
  2⤵
  PID:3872
- C:\Program Files\Java\jre-1.8\bin\server\backup.exe
  "C:\Program Files\Java\jre-1.8\bin\server\backup.exe" C:\Program Files\Java\jre-1.8\bin\server\
  2⤵
  PID:1088

C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe
"C:\Program Files\Java\jre-1.8\legal\javafx\backup.exe" C:\Program Files\Java\jre-1.8\legal\javafx\
1⤵
PID:1208

C:\Program Files\Java\jre-1.8\lib\images\cursors\System Restore.exe
"C:\Program Files\Java\jre-1.8\lib\images\cursors\System Restore.exe" C:\Program Files\Java\jre-1.8\lib\images\cursors\
1⤵
PID:4528

C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe
"C:\Program Files\Java\jre-1.8\lib\security\policy\limited\backup.exe" C:\Program Files\Java\jre-1.8\lib\security\policy\limited\
1⤵
PID:1944

C:\Program Files\Microsoft Office\root\Client\backup.exe
"C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
1⤵
PID:3280

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
1⤵
PID:1820

C:\Program Files\Microsoft Office\root\Licenses\backup.exe
"C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\
1⤵
PID:4796

C:\Program Files\Microsoft Office\root\loc\data.exe
"C:\Program Files\Microsoft Office\root\loc\data.exe" C:\Program Files\Microsoft Office\root\loc\
1⤵
PID:1608

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\
1⤵
PID:2480
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\data.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\
  2⤵
  PID:4844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\
    3⤵
    PID:3100

C:\Program Files (x86)\update.exe
"C:\Program Files (x86)\update.exe" C:\Program Files (x86)\
1⤵
PID:3292
- C:\Program Files (x86)\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:828
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:3336
- - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe
    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\
    3⤵
    PID:4888
  - - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System Restore.exe
      "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System Restore.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\
      4⤵
      PID:1372
    - - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\
        5⤵
        
        PID:3036
    - - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\
        5⤵
        
        PID:560
    - - C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\
        5⤵
        
        PID:1724
- C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
  2⤵
  PID:4696
- C:\Program Files (x86)\MSBuild\System Restore.exe
  "C:\Program Files (x86)\MSBuild\System Restore.exe" C:\Program Files (x86)\MSBuild\
  2⤵
  PID:2480
- C:\Program Files (x86)\Windows Defender\backup.exe
  "C:\Program Files (x86)\Windows Defender\backup.exe" C:\Program Files (x86)\Windows Defender\
  2⤵
  PID:4520
- - C:\Program Files (x86)\Windows Defender\es-ES\backup.exe
    "C:\Program Files (x86)\Windows Defender\es-ES\backup.exe" C:\Program Files (x86)\Windows Defender\es-ES\
    3⤵
    PID:3200

C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
1⤵
PID:2868
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
  2⤵
  PID:3480
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
    3⤵
    PID:3924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
    3⤵
    PID:1212
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
      4⤵
      PID:5092
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
    3⤵
    PID:1976
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\
      4⤵
      PID:716
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
    3⤵
    PID:1896
  - - C:\Windows\apppatch\es-ES\update.exe
      C:\Windows\apppatch\es-ES\update.exe C:\Windows\apppatch\es-ES\
      4⤵
      PID:388
- C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\
  2⤵
  PID:392
- C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
  2⤵
  PID:4908
- C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
  2⤵
  PID:3336
- C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
  2⤵
  PID:1372
- C:\Program Files\VideoLAN\VLC\locale\brx\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\brx\data.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
  2⤵
  PID:1276
- C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
  2⤵
  PID:4860
- C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\
  2⤵
  PID:4368
- C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
  2⤵
  PID:752
- - C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
    3⤵
    PID:1476
- C:\Program Files\VideoLAN\VLC\locale\el\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\
  2⤵
  PID:2832
- - C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
    3⤵
    PID:1200
- C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
  2⤵
  PID:2132
- C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
  2⤵
  PID:2180
- C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
  2⤵
  PID:3740
- - C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
    3⤵
    PID:5068
- C:\Program Files\VideoLAN\VLC\locale\fur\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\fur\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\fur\
  2⤵
  PID:1240
- C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
  2⤵
  PID:2484
- - C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
    3⤵
    PID:1796
- C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
  2⤵
  PID:748
- - C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
    3⤵
    PID:2664
  - - C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\
      4⤵
      PID:2484
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\
    3⤵
    PID:4984
- C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
  2⤵
  PID:1120
- - C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
    3⤵
    PID:536
- C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\
  2⤵
  PID:3244
- C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
  2⤵
  PID:1056
- C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
  2⤵
  PID:1508
- - C:\Windows\INF\ESENT\backup.exe
    C:\Windows\INF\ESENT\backup.exe C:\Windows\INF\ESENT\
    3⤵
    PID:984
  - - C:\Windows\INF\ESENT\0000\backup.exe
      C:\Windows\INF\ESENT\0000\backup.exe C:\Windows\INF\ESENT\0000\
      4⤵
      PID:3568
  - - C:\Windows\INF\ESENT\040C\System Restore.exe
      "C:\Windows\INF\ESENT\040C\System Restore.exe" C:\Windows\INF\ESENT\040C\
      4⤵
      PID:3244
  - - C:\Windows\INF\ESENT\0411\backup.exe
      C:\Windows\INF\ESENT\0411\backup.exe C:\Windows\INF\ESENT\0411\
      4⤵
      PID:3624
  - - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\0c671454f3bec22322ca78eade5d677c\backup.exe
      C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\0c671454f3bec22322ca78eade5d677c\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\0c671454f3bec22322ca78eade5d677c\
      4⤵
      PID:3348
- - C:\Windows\INF\MSDTC\update.exe
    C:\Windows\INF\MSDTC\update.exe C:\Windows\INF\MSDTC\
    3⤵
    PID:2664
  - - C:\Windows\INF\MSDTC\0C0A\backup.exe
      C:\Windows\INF\MSDTC\0C0A\backup.exe C:\Windows\INF\MSDTC\0C0A\
      4⤵
      PID:4812
- - C:\Windows\INF\MSDTC Bridge 3.0.0.0\backup.exe
    "C:\Windows\INF\MSDTC Bridge 3.0.0.0\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\
    3⤵
    PID:1120
  - - C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\backup.exe
      "C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0409\
      4⤵
      PID:4696
  - - C:\Windows\INF\MSDTC Bridge 3.0.0.0\040C\backup.exe
      "C:\Windows\INF\MSDTC Bridge 3.0.0.0\040C\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\040C\
      4⤵
      PID:2076
  - - C:\Windows\INF\MSDTC Bridge 3.0.0.0\0410\backup.exe
      "C:\Windows\INF\MSDTC Bridge 3.0.0.0\0410\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0410\
      4⤵
      PID:2460
  - - C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\backup.exe
      "C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\
      4⤵
      PID:2836
  - - C:\Windows\INF\MSDTC Bridge 3.0.0.0\0C0A\backup.exe
      "C:\Windows\INF\MSDTC Bridge 3.0.0.0\0C0A\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0C0A\
      4⤵
      PID:2936
  - - C:\Windows\INF\MSDTC Bridge 3.0.0.0\0407\backup.exe
      "C:\Windows\INF\MSDTC Bridge 3.0.0.0\0407\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0407\
      4⤵
      PID:3624
    - - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\
        5⤵
        
        PID:3580
  - - C:\Windows\INF\MSDTC Bridge 3.0.0.0\0000\backup.exe
      "C:\Windows\INF\MSDTC Bridge 3.0.0.0\0000\backup.exe" C:\Windows\INF\MSDTC Bridge 3.0.0.0\0000\
      4⤵
      PID:1416
- - C:\Windows\INF\LSM\backup.exe
    C:\Windows\INF\LSM\backup.exe C:\Windows\INF\LSM\
    3⤵
    PID:3752
- - C:\Windows\INF\MSDTC Bridge 4.0.0.0\backup.exe
    "C:\Windows\INF\MSDTC Bridge 4.0.0.0\backup.exe" C:\Windows\INF\MSDTC Bridge 4.0.0.0\
    3⤵
    PID:4440
- - C:\Windows\INF\en-US\backup.exe
    C:\Windows\INF\en-US\backup.exe C:\Windows\INF\en-US\
    3⤵
    PID:1200
- - C:\Windows\INF\BITS\backup.exe
    C:\Windows\INF\BITS\backup.exe C:\Windows\INF\BITS\
    3⤵
    PID:3972
- C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
  2⤵
  PID:4108
- C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
  2⤵
  PID:4568
- C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\
  2⤵
  PID:2388
- - C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
    3⤵
    PID:4628
- C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
  2⤵
  PID:752
- - C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
    3⤵
    PID:4000
- C:\Program Files\VideoLAN\VLC\locale\mai\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\mai\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
  2⤵
  PID:3176
- - C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\
    3⤵
    PID:4652
- C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
  2⤵
  PID:2392
- C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
  2⤵
  PID:1544
- - C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
    3⤵
    PID:2304
- C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
  2⤵
  PID:3296
- - C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
    3⤵
    PID:2008
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\
    3⤵
    PID:4960
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\
    3⤵
    PID:388
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\
    3⤵
    PID:4088
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\
    3⤵
    PID:1164
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\
    3⤵
    PID:4984
- C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
  2⤵
  PID:4356
- C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
  2⤵
  PID:2304
- - C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
    3⤵
    PID:2988
- C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\
  2⤵
  PID:2428
- - C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
    3⤵
    PID:3968
- C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
  2⤵
  PID:1068
- C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
  2⤵
  PID:1144
- C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
  2⤵
  PID:4796
- C:\Program Files\VideoLAN\VLC\locale\nn\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\nn\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
  2⤵
  PID:3720
- C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
  2⤵
  PID:2704
- - C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
    3⤵
    PID:2080
- C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
  2⤵
  PID:5084
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\
    3⤵
    PID:4112
- C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\
  2⤵
  PID:4800
- - C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\
    3⤵
    PID:2920
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_it_b03f5f7f11d50a3a\
    3⤵
    PID:1608
  - - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\
      4⤵
      PID:4920
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\
    3⤵
    PID:5076
- - C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
    C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\2.0.0.0_es_b03f5f7f11d50a3a\
    3⤵
    PID:4500
- C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
  2⤵
  PID:432
- - C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\System Restore.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\System Restore.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\
    3⤵
    PID:2800
- C:\Program Files\VideoLAN\VLC\locale\pt_PT\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_PT\update.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
  2⤵
  PID:2272
- C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\
  2⤵
  PID:1124
- C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
  2⤵
  PID:1564
- C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
  2⤵
  PID:1944
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\backup.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\
    3⤵
    PID:2012
- C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
  2⤵
  PID:876
- C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\
  2⤵
  PID:628
- C:\Program Files\VideoLAN\VLC\locale\lt\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\lt\data.exe" C:\Program Files\VideoLAN\VLC\locale\lt\
  2⤵
  PID:1056
- C:\Program Files\VideoLAN\VLC\locale\lg\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\lg\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
  2⤵
  PID:3100
- C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\
  2⤵
  PID:1548
- C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\
  2⤵
  PID:1564
- C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\
  2⤵
  PID:1756

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
1⤵
PID:1068

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\
1⤵
PID:3336

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\
1⤵
PID:1068

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\
1⤵
PID:1320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\
1⤵
PID:4984
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\
  2⤵
  PID:984
- - C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\backup.exe
    "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\
    3⤵
    PID:2356
  - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\data.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\
      4⤵
      PID:464
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\
      4⤵
      PID:536
    - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\
        5⤵
        
        PID:1792
- - C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\data.exe
    "C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\data.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\
    3⤵
    PID:5104

C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\backup.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\backup.exe" C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\
1⤵
PID:2976

C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
"C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
1⤵
PID:1356

C:\Program Files\Mozilla Firefox\data.exe
"C:\Program Files\Mozilla Firefox\data.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:1936
- C:\Program Files\Mozilla Firefox\browser\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
  2⤵
  PID:1124
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\
    3⤵
    PID:3784
- C:\Program Files\Mozilla Firefox\fonts\backup.exe
  "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
  2⤵
  PID:444
- C:\Program Files\Mozilla Firefox\gmp-clearkey\System Restore.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\System Restore.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
  2⤵
  PID:1144
- - C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
    "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
    3⤵
    PID:4468
  - - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\
      4⤵
      PID:2388
- C:\Program Files\Mozilla Firefox\uninstall\System Restore.exe
  "C:\Program Files\Mozilla Firefox\uninstall\System Restore.exe" C:\Program Files\Mozilla Firefox\uninstall\
  2⤵
  PID:2988

C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\BC511AE6-709C-4371-BC56-72ECE237F064\backup.exe
"C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\BC511AE6-709C-4371-BC56-72ECE237F064\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\BC511AE6-709C-4371-BC56-72ECE237F064\
1⤵
PID:2132
- C:\Users\Admin\Pictures\Saved Pictures\backup.exe
  "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
  2⤵
  PID:4544

C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Fonts\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Fonts\
1⤵
PID:3960

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:3092
- C:\Users\Admin\backup.exe
  C:\Users\Admin\backup.exe C:\Users\Admin\
  2⤵
  PID:4892
- - C:\Users\Admin\OneDrive\backup.exe
    C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
    3⤵
    PID:1736
- - C:\Users\Admin\Searches\backup.exe
    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
    3⤵
    PID:1736
- C:\Users\Public\backup.exe
  C:\Users\Public\backup.exe C:\Users\Public\
  2⤵
  PID:2144
- - C:\Users\Public\Documents\backup.exe
    C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
    3⤵
    PID:3500
  - - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe
      "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\
      4⤵
      PID:2232
    - - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\backup.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\
        5⤵
        
        PID:3568
- - C:\Users\Public\Pictures\backup.exe
    C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
    3⤵
    PID:2856

C:\Program Files (x86)\Common Files\Adobe\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
1⤵
PID:1088
- C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
  2⤵
  PID:3420
- - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
    3⤵
    PID:2944
- - C:\Program Files (x86)\Google\CrashReports\backup.exe
    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
    3⤵
    PID:4420
- - C:\Program Files (x86)\Google\Temp\backup.exe
    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
    3⤵
    PID:2132

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
1⤵
PID:2912

C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\BC511AE6-709C-4371-BC56-72ECE237F064\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe
"C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\BC511AE6-709C-4371-BC56-72ECE237F064\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\BC511AE6-709C-4371-BC56-72ECE237F064\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\
1⤵
PID:4716
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\
  2⤵
  PID:5068

C:\Program Files\MSBuild\Microsoft\backup.exe
"C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
1⤵
PID:1944

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
1⤵
PID:1228
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
  2⤵
  PID:2984
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
  2⤵
  PID:1620

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
1⤵
PID:3348

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:4428
- C:\Program Files\VideoLAN\VLC\backup.exe
  "C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
  2⤵
  PID:2392
- - C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
    "C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
    3⤵
    PID:1068
  - - C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
      4⤵
      PID:2936
- - C:\Program Files\VideoLAN\VLC\lua\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
    3⤵
    PID:3256
  - - C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
      4⤵
      PID:956
  - - C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
      4⤵
      PID:3064
  - - C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\backup.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\
      4⤵
      PID:1496

C:\Program Files (x86)\Common Files\Java\backup.exe
"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
1⤵
PID:4720
- C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
  "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
  2⤵
  PID:4908

C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
1⤵
PID:1496
- C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\data.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
  2⤵
  PID:2144
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\data.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\
    3⤵
    PID:3740
  - - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
      "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\
      4⤵
      PID:4892
    - - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
        5⤵
        
        PID:4844
- C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\
  2⤵
  PID:1308
- - C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\update.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\
    3⤵
    PID:1276
- C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\
  2⤵
  PID:1372
- C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\
  2⤵
  PID:3856
- - C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\
    3⤵
    PID:2904
  - - C:\Windows\Help\Windows\IndexStore\backup.exe
      C:\Windows\Help\Windows\IndexStore\backup.exe C:\Windows\Help\Windows\IndexStore\
      4⤵
      PID:364
- - C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe
    "C:\Program Files (x86)\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\de-DE\
    3⤵
    PID:2348
- - C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe
    "C:\Program Files (x86)\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\es-ES\
    3⤵
    PID:3772
- C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\
  2⤵
  PID:3852
- - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\
    3⤵
    PID:2408
  - - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\
      4⤵
      PID:3784
- - C:\Windows\ImmersiveControlPanel\SystemSettings\View\System Restore.exe
    "C:\Windows\ImmersiveControlPanel\SystemSettings\View\System Restore.exe" C:\Windows\ImmersiveControlPanel\SystemSettings\View\
    3⤵
    PID:748

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\
1⤵
PID:1800

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\data.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\data.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\
1⤵
PID:2052
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\
  2⤵
  PID:2564
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\
  2⤵
  PID:3200

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
1⤵
PID:3280

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
1⤵
PID:752

C:\Program Files (x86)\Google\Update\Install\{6FB5F2B8-50C9-4E27-9F75-756369A42747}\backup.exe
"C:\Program Files (x86)\Google\Update\Install\{6FB5F2B8-50C9-4E27-9F75-756369A42747}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{6FB5F2B8-50C9-4E27-9F75-756369A42747}\
1⤵
PID:1516
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\
  2⤵
  PID:4468
- C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\
  2⤵
  PID:5012
- C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\
  2⤵
  PID:3500

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\
1⤵
PID:4464

C:\Program Files (x86)\Google\Update\Offline\backup.exe
"C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
1⤵
PID:3616

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\
1⤵
PID:1088

C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:4644

C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:4648

C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
1⤵
PID:3340
- C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
  2⤵
  PID:1164

C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:3924

C:\Program Files (x86)\Common Files\Oracle\backup.exe
"C:\Program Files (x86)\Common Files\Oracle\backup.exe" C:\Program Files (x86)\Common Files\Oracle\
1⤵
PID:3704

C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\
1⤵
PID:3612
- C:\Program Files (x86)\Common Files\System\en-US\update.exe
  "C:\Program Files (x86)\Common Files\System\en-US\update.exe" C:\Program Files (x86)\Common Files\System\en-US\
  2⤵
  PID:3280
- C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\System\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ja-JP\
  2⤵
  PID:1308
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\
    3⤵
    PID:2828
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\
    3⤵
    PID:5032
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\
    3⤵
    PID:4520
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\
    3⤵
    PID:4696
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\
    3⤵
    PID:2356

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\System Restore.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\System Restore.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:4700

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\
1⤵
PID:3960

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\
1⤵
PID:2564
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\
  2⤵
  PID:1276
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\
  2⤵
  PID:2428
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\
  2⤵
  PID:864
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\
  2⤵
  PID:3272
- - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\410cb32fbed28bfc3ce04df7c4f70c33\backup.exe
    C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\410cb32fbed28bfc3ce04df7c4f70c33\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\410cb32fbed28bfc3ce04df7c4f70c33\
    3⤵
    PID:4488
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\
  2⤵
  PID:4332
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\
  2⤵
  PID:1552
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\
  2⤵
  PID:4208
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\
  2⤵
  PID:3784
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\
  2⤵
  PID:4692
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\
  2⤵
  PID:1720
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\data.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\
  2⤵
  PID:2132
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\
  2⤵
  PID:3824
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\
  2⤵
  PID:4088

C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
1⤵
PID:536

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\
1⤵
PID:1908
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\
  2⤵
  PID:4700
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\
  2⤵
  PID:2428

C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
1⤵
PID:888

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\
1⤵
PID:1736
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\
  2⤵
  PID:4464
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\
  2⤵
  PID:3420
- - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\backup.exe
    "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\
    3⤵
    PID:912

C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_32\srmlib\1.0.0.0__31bf3856ad364e35\
1⤵
PID:1884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\
1⤵
PID:3960

C:\Program Files\Windows Photo Viewer\backup.exe
"C:\Program Files\Windows Photo Viewer\backup.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:1936
- C:\Program Files\Windows Photo Viewer\de-DE\backup.exe
  "C:\Program Files\Windows Photo Viewer\de-DE\backup.exe" C:\Program Files\Windows Photo Viewer\de-DE\
  2⤵
  PID:3556
- C:\Program Files\Windows Photo Viewer\es-ES\backup.exe
  "C:\Program Files\Windows Photo Viewer\es-ES\backup.exe" C:\Program Files\Windows Photo Viewer\es-ES\
  2⤵
  PID:1964
- C:\Program Files\Windows Photo Viewer\fr-FR\update.exe
  "C:\Program Files\Windows Photo Viewer\fr-FR\update.exe" C:\Program Files\Windows Photo Viewer\fr-FR\
  2⤵
  PID:2512
- C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe
  "C:\Program Files\Windows Photo Viewer\ja-JP\backup.exe" C:\Program Files\Windows Photo Viewer\ja-JP\
  2⤵
  PID:2168

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\
1⤵
PID:4700

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\backup.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\
1⤵
PID:4648

C:\Program Files\Microsoft Office\root\vfs\Windows\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\
1⤵
PID:2176

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
1⤵
PID:1980

C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe
C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\
1⤵
PID:912
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\
  2⤵
  PID:4488

C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\
1⤵
PID:4420

C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\
1⤵
PID:3092

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\
1⤵
PID:1372

C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\
1⤵
PID:3712

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\
1⤵
PID:4128

C:\Program Files\Windows Security\backup.exe
"C:\Program Files\Windows Security\backup.exe" C:\Program Files\Windows Security\
1⤵
PID:4640
- C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe
  "C:\Program Files (x86)\Windows Media Player\fr-FR\backup.exe" C:\Program Files (x86)\Windows Media Player\fr-FR\
  2⤵
  PID:4296
- C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe
  "C:\Program Files (x86)\Windows Media Player\Media Renderer\backup.exe" C:\Program Files (x86)\Windows Media Player\Media Renderer\
  2⤵
  PID:4692
- C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe
  "C:\Program Files (x86)\Windows Media Player\Visualizations\backup.exe" C:\Program Files (x86)\Windows Media Player\Visualizations\
  2⤵
  PID:2252
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\
    3⤵
    PID:1660
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\
    3⤵
    PID:2708
  - - C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\
      4⤵
      PID:2316
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\update.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\update.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\
    3⤵
    PID:324
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\
    3⤵
    PID:536
  - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\update.exe
      "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\update.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\
      4⤵
      PID:3488
  - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\
      4⤵
      PID:1564
    - - C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\589b59854d0a7a4ef9c0a2adf4c00fd9\backup.exe
        
        C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\589b59854d0a7a4ef9c0a2adf4c00fd9\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\589b59854d0a7a4ef9c0a2adf4c00fd9\
        5⤵
        
        PID:1372
      - C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\backup.exe
        
        "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\
        6⤵
        
        PID:956
  - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\
      4⤵
      PID:3236
- - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\
    3⤵
    PID:1288
  - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\
      4⤵
      PID:3872
  - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\data.exe
      "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\data.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\
      4⤵
      PID:4356
  - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\
      4⤵
      PID:2180
  - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\
      4⤵
      PID:2460
  - - C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\backup.exe
      "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\
      4⤵
      PID:1212

C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
1⤵
PID:1884

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:876
- C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
  2⤵
  PID:3532

C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\backup.exe
"C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\
1⤵
PID:2232
- C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\backup.exe
  "C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\backup.exe" C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QSIGNOFF\
  2⤵
  PID:1660

C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\
1⤵
PID:3472

C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
1⤵
PID:3968

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\
1⤵
PID:2144

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\
1⤵
PID:4752

C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe
"C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3236

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\
1⤵
PID:2664

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\
1⤵
PID:2828

C:\Windows\Help\mui\0409\backup.exe
C:\Windows\Help\mui\0409\backup.exe C:\Windows\Help\mui\0409\
1⤵
PID:956
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\System Restore.exe
  "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\System Restore.exe" C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\
  2⤵
  PID:3648

C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe
C:\Windows\assembly\GAC_MSIL\cscompmgd\backup.exe C:\Windows\assembly\GAC_MSIL\cscompmgd\
1⤵
PID:4064

C:\Windows\Help\mui\040C\backup.exe
C:\Windows\Help\mui\040C\backup.exe C:\Windows\Help\mui\040C\
1⤵
PID:2912
- C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\backup.exe
  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ga41585c2#\8d4be6e5a963721e5560e61d906a875a\
  2⤵
  PID:1088

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\
1⤵
PID:2920
- C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
  2⤵
  PID:4996

C:\Windows\Help\mui\0410\backup.exe
C:\Windows\Help\mui\0410\backup.exe C:\Windows\Help\mui\0410\
1⤵
PID:4808

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\
1⤵
PID:2984

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\
1⤵
PID:3784

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\
1⤵
PID:3336

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\
1⤵
PID:4844

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\06e4ead630bb224419e9830affdafb8c\
1⤵
PID:2188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\
1⤵
PID:316

C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2132

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\
1⤵
PID:1476

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\
1⤵
PID:1620

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\
1⤵
PID:2664
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\
  2⤵
  PID:752
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\
    3⤵
    PID:3640
- C:\Windows\INF\MSDTC\0000\backup.exe
  C:\Windows\INF\MSDTC\0000\backup.exe C:\Windows\INF\MSDTC\0000\
  2⤵
  PID:628
- C:\Windows\INF\MSDTC\0411\backup.exe
  C:\Windows\INF\MSDTC\0411\backup.exe C:\Windows\INF\MSDTC\0411\
  2⤵
  PID:3460
- C:\Windows\INF\MSDTC\0410\backup.exe
  C:\Windows\INF\MSDTC\0410\backup.exe C:\Windows\INF\MSDTC\0410\
  2⤵
  PID:4188
- C:\Windows\INF\MSDTC\040C\backup.exe
  C:\Windows\INF\MSDTC\040C\backup.exe C:\Windows\INF\MSDTC\040C\
  2⤵
  PID:1476
- C:\Windows\INF\MSDTC\0409\backup.exe
  C:\Windows\INF\MSDTC\0409\backup.exe C:\Windows\INF\MSDTC\0409\
  2⤵
  PID:2232
- C:\Windows\INF\MSDTC\0407\backup.exe
  C:\Windows\INF\MSDTC\0407\backup.exe C:\Windows\INF\MSDTC\0407\
  2⤵
  PID:3872

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f18ff42b17aa9990ee61ad0c4aea9b1c\
1⤵
PID:2180

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:2316
- C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\
  2⤵
  PID:3212
- C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\
  2⤵
  PID:536
- C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\
  2⤵
  PID:3784
- C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\
  2⤵
  PID:4596

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\
1⤵
PID:5004

C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\
1⤵
PID:3108

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\
1⤵
PID:2988

C:\Program Files (x86)\Windows NT\TableTextService\backup.exe
"C:\Program Files (x86)\Windows NT\TableTextService\backup.exe" C:\Program Files (x86)\Windows NT\TableTextService\
1⤵
PID:1272

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\
1⤵
PID:1484

C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
1⤵
PID:2956

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\
1⤵
PID:3752

C:\Windows\IME\IMEJP\Assets\backup.exe
C:\Windows\IME\IMEJP\Assets\backup.exe C:\Windows\IME\IMEJP\Assets\
1⤵
PID:548

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\System Restore.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\
1⤵
PID:2624

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\
1⤵
PID:316

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\3526cd5a741d8cbdf5fa48b7f6fe88d3\
1⤵
PID:4488

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu\
1⤵
PID:1388

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\
1⤵
PID:4400

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\
1⤵
PID:1704

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\
1⤵
PID:2788

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\
1⤵
PID:2484
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:3484

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\
1⤵
PID:1028
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2280

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\
1⤵
PID:3800

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\
1⤵
PID:1456
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_es_b03f5f7f11d50a3a\
  2⤵
  PID:2884
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:4580
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:1120
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\
  2⤵
  PID:4568
- - C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
    3⤵
    PID:2188
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_de_b03f5f7f11d50a3a\
  2⤵
  PID:4176

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\
1⤵
PID:1976

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\
1⤵
PID:3824

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b78cfccbd1eab27ca35b2ac67d102907\
1⤵
PID:4488

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
1⤵
PID:8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\
1⤵
PID:1704

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\
1⤵
PID:2252
- C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\System Restore.exe
  "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\System Restore.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\
  2⤵
  PID:2012
- C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\
  2⤵
  PID:3180
- - C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\
    3⤵
    PID:620
- C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\System Restore.exe
  "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\System Restore.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\
  2⤵
  PID:1660
- C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\
  2⤵
  PID:1372
- C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\backup.exe" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\
  2⤵
  PID:2988

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\
1⤵
PID:4692

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\
1⤵
PID:1704
- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:2144

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\
1⤵
PID:4376

C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\
1⤵
PID:2976
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_de_31bf3856ad364e35\
  2⤵
  PID:208
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\
  2⤵
  PID:3640
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:864
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:1604

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
1⤵
PID:4908

C:\Windows\INF\BITS\0407\backup.exe
C:\Windows\INF\BITS\0407\backup.exe C:\Windows\INF\BITS\0407\
1⤵
PID:2460

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\
1⤵
PID:1792

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\
1⤵
PID:3532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\
1⤵
PID:4984
- C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\
  2⤵
  PID:3280
- C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\backup.exe
  "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\
  2⤵
  PID:4700

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\
1⤵
PID:3328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\update.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\
1⤵
PID:224
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\
  2⤵
  PID:3108
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\
  2⤵
  PID:2988
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\
  2⤵
  PID:4892
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\
  2⤵
  PID:4220
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\
  2⤵
  PID:2512
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\
  2⤵
  PID:4892
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\
  2⤵
  PID:3316
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\
  2⤵
  PID:1908
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\
  2⤵
  PID:2008
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\
  2⤵
  PID:3516
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\
  2⤵
  PID:4356
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\
  2⤵
  PID:4888
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\data.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\
  2⤵
  PID:3616
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\
  2⤵
  PID:2180
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\
  2⤵
  PID:4708
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\
  2⤵
  PID:868
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\
  2⤵
  PID:1544
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\
  2⤵
  PID:2180
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\
  2⤵
  PID:3284
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\
  2⤵
  PID:324
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\
  2⤵
  PID:2368
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\data.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\
  2⤵
  PID:2304
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\System Restore.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\
  2⤵
  PID:208
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\
  2⤵
  PID:4724
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\
  2⤵
  PID:2960
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\
  2⤵
  PID:4844
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\
  2⤵
  PID:1724
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\
  2⤵
  PID:3524
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\
  2⤵
  PID:3064
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\
  2⤵
  PID:3960
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\update.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\
  2⤵
  PID:3292
- - C:\Program Files (x86)\WindowsPowerShell\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\backup.exe" C:\Program Files (x86)\WindowsPowerShell\
    3⤵
    PID:2564
- - C:\Program Files (x86)\Windows Portable Devices\backup.exe
    "C:\Program Files (x86)\Windows Portable Devices\backup.exe" C:\Program Files (x86)\Windows Portable Devices\
    3⤵
    PID:3484
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\
  2⤵
  PID:4036
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\
  2⤵
  PID:1536
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\update.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\
  2⤵
  PID:1620

C:\Windows\INF\BITS\0409\backup.exe
C:\Windows\INF\BITS\0409\backup.exe C:\Windows\INF\BITS\0409\
1⤵
PID:2612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\
1⤵
PID:3484

C:\Windows\INF\BITS\0410\backup.exe
C:\Windows\INF\BITS\0410\backup.exe C:\Windows\INF\BITS\0410\
1⤵
PID:4812

C:\Windows\INF\BITS\0411\backup.exe
C:\Windows\INF\BITS\0411\backup.exe C:\Windows\INF\BITS\0411\
1⤵
PID:3752
- C:\Windows\INF\LSM\0000\backup.exe
  C:\Windows\INF\LSM\0000\backup.exe C:\Windows\INF\LSM\0000\
  2⤵
  PID:2316
- - C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\
    3⤵
    PID:3752
  - - C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\08fef1ab031995fea10e25462c407120\backup.exe
      C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\08fef1ab031995fea10e25462c407120\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\srmlib\08fef1ab031995fea10e25462c407120\
      4⤵
      PID:868
- - C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\backup.exe
    "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\
    3⤵
    PID:4708
- C:\Windows\INF\LSM\0409\data.exe
  C:\Windows\INF\LSM\0409\data.exe C:\Windows\INF\LSM\0409\
  2⤵
  PID:5084
- - C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
    3⤵
    PID:2392
  - - C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
      4⤵
      PID:1912
- C:\Windows\INF\LSM\0410\backup.exe
  C:\Windows\INF\LSM\0410\backup.exe C:\Windows\INF\LSM\0410\
  2⤵
  PID:4040
- C:\Windows\INF\LSM\0411\backup.exe
  C:\Windows\INF\LSM\0411\backup.exe C:\Windows\INF\LSM\0411\
  2⤵
  PID:4652
- C:\Windows\INF\LSM\0C0A\backup.exe
  C:\Windows\INF\LSM\0C0A\backup.exe C:\Windows\INF\LSM\0C0A\
  2⤵
  PID:1028
- C:\Windows\INF\LSM\040C\backup.exe
  C:\Windows\INF\LSM\040C\backup.exe C:\Windows\INF\LSM\040C\
  2⤵
  PID:2144
- C:\Windows\INF\LSM\0407\backup.exe
  C:\Windows\INF\LSM\0407\backup.exe C:\Windows\INF\LSM\0407\
  2⤵
  PID:4812

C:\Windows\INF\BITS\0C0A\backup.exe
C:\Windows\INF\BITS\0C0A\backup.exe C:\Windows\INF\BITS\0C0A\
1⤵
PID:2996

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\
1⤵
PID:3336
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_de_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_de_b03f5f7f11d50a3a\
  2⤵
  PID:5104
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_it_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_it_b03f5f7f11d50a3a\
  2⤵
  PID:1104
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_ja_b03f5f7f11d50a3a\
  2⤵
  PID:3852
- - C:\Windows\ImmersiveControlPanel\SystemSettings\Assets\backup.exe
    C:\Windows\ImmersiveControlPanel\SystemSettings\Assets\backup.exe C:\Windows\ImmersiveControlPanel\SystemSettings\Assets\
    3⤵
    PID:2624
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_fr_b03f5f7f11d50a3a\
  2⤵
  PID:3328

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\backup.exe
"C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\
1⤵
PID:4456
- C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\
  2⤵
  PID:3292
- C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\update.exe
  "C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\update.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\
  2⤵
  PID:3460
- C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\fr\
  2⤵
  PID:3856
- - C:\Program Files (x86)\Windows Photo Viewer\ja-JP\backup.exe
    "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\ja-JP\
    3⤵
    PID:1212
- - C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe
    "C:\Program Files (x86)\Windows Photo Viewer\it-IT\backup.exe" C:\Program Files (x86)\Windows Photo Viewer\it-IT\
    3⤵
    PID:4708
- C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\
  2⤵
  PID:4948
- C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\it\
  2⤵
  PID:4960
- C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\backup.exe
  "C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\backup.exe" C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\
  2⤵
  PID:2624
- C:\Windows\IME\IMEKR\backup.exe
  C:\Windows\IME\IMEKR\backup.exe C:\Windows\IME\IMEKR\
  2⤵
  PID:4796

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\
1⤵
PID:452
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\
  2⤵
  PID:3408
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_es_31bf3856ad364e35\
  2⤵
  PID:4440
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_it_31bf3856ad364e35\
  2⤵
  PID:1740
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2460
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_fr_31bf3856ad364e35\
  2⤵
  PID:2920
- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\
  2⤵
  PID:912
- - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\eb603fa6eb1f1fdefda6ce5d5c1c889a\backup.exe
    C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\eb603fa6eb1f1fdefda6ce5d5c1c889a\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\eb603fa6eb1f1fdefda6ce5d5c1c889a\
    3⤵
    PID:5032

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\
1⤵
PID:3792
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:388

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\
1⤵
PID:1104
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\data.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\
  2⤵
  PID:3284
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\15.0.0.0__71e9bce111e9429c\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\15.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:4752

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\backup.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\
1⤵
PID:1124
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\backup.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\
  2⤵
  PID:1724
- C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
  2⤵
  PID:2428
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\
    3⤵
    PID:888

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\
1⤵
PID:396

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\
1⤵
PID:3568

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\
1⤵
PID:3716

C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
1⤵
PID:2392

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\
1⤵
PID:2900
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\System Restore.exe
  "C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\System Restore.exe" C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:3720

C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\
1⤵
PID:4716

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\
1⤵
PID:1176
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\
  2⤵
  PID:2484

C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\4bf48e6215e868c5f15ab3cf5e717b90\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\4bf48e6215e868c5f15ab3cf5e717b90\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\4bf48e6215e868c5f15ab3cf5e717b90\
1⤵
PID:4208

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\
1⤵
PID:3336
- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_es_b03f5f7f11d50a3a\
  2⤵
  PID:1728
- - C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\backup.exe
    "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\
    3⤵
    PID:452

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\data.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\
1⤵
PID:2704

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb#\3af15851d0895c008963e8edc7223233\backup.exe
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb#\3af15851d0895c008963e8edc7223233\backup.exe C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P655586bb#\3af15851d0895c008963e8edc7223233\
1⤵
PID:316

C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
1⤵
PID:4220

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\
1⤵
PID:3080

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\
1⤵
PID:2976
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_ja_31bf3856ad364e35\
  2⤵
  PID:2168
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\
  2⤵
  PID:1176
- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\
  2⤵
  PID:4064

C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\
1⤵
PID:1028

C:\Windows\INF\BITS\040C\backup.exe
C:\Windows\INF\BITS\040C\backup.exe C:\Windows\INF\BITS\040C\
1⤵
PID:560

C:\Windows\INF\BITS\0000\backup.exe
C:\Windows\INF\BITS\0000\backup.exe C:\Windows\INF\BITS\0000\
1⤵
PID:1564
- C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
  2⤵
  PID:560

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\f334dca9ae9dc06224e9b43875b3aa90\data.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\f334dca9ae9dc06224e9b43875b3aa90\data.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\f334dca9ae9dc06224e9b43875b3aa90\
1⤵
PID:3568

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\backup.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\backup.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\83a3b8af1eee54050fa565ab6fc8e5d9\
1⤵
PID:5012

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\
1⤵
PID:5084

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\291910c52afc6a4c83bd042f709c7e57\update.exe
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\291910c52afc6a4c83bd042f709c7e57\update.exe C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\291910c52afc6a4c83bd042f709c7e57\
1⤵
PID:2704
- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\data.exe
  C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\data.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.v9.0\9.0.0.0__b03f5f7f11d50a3a\
  2⤵
  PID:4596

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\backup.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\backup.exe" C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\
1⤵
PID:1728

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.Resources\
1⤵
PID:4800

C:\Windows\IME\IMEJP\help\backup.exe
C:\Windows\IME\IMEJP\help\backup.exe C:\Windows\IME\IMEJP\help\
1⤵
PID:2180

C:\Windows\IME\IMEJP\DICTS\System Restore.exe
"C:\Windows\IME\IMEJP\DICTS\System Restore.exe" C:\Windows\IME\IMEJP\DICTS\
1⤵
PID:2472

C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\backup.exe
C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\backup.exe C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
5ad31c2da25e147a21cbec72e7b17277

SHA1
f84ad441f2d72084a843cd737db2e724c1b17b48

SHA256
516f91801d9896a261bece59c4b1551d8499f9b2e6062f797a249ea006fe212d

SHA512
afddeff30108869c7a4963f4f8a441f55d432ff0a2e763d5f2be7a9cb64a231fc51cbc40d6622f699c4cf5679c2aba5ceaf31269f6b6c8b72d6d6f00c02c96f4

Download Submit
C:\Program Files\Common Files\microsoft shared\backup.exe

Filesize
72KB

MD5
f71823e41803cb43796b1aefb6263450

SHA1
9d956073254d12d5299567f6aee10a74d362fbe7

SHA256
d66da39323295f504f8303041f49e0ddf26f82369b8837f31504f23c3880cbca

SHA512
ef2472400bb918bde1e5232e52bbc992b200054a58a29dfa8e2950d6a411c684beaa2e4f78eb213d095e5b369b0dc10a747fe840626548af41c4704047a90e26

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\backup.exe

Filesize
72KB

MD5
cb905ad9f4b8358b6f0cb79786c86958

SHA1
b5523136d40fa62622466a6ef9939b9b67293f3e

SHA256
26756881e5e75be4807fabbd26bf7755097ce352dbe3487a539c96c2b457bcf3

SHA512
f2e924f5c5f0e87bb4ea3dfc834607ed64d5f5c4333a1b50e0a4da14aa899e534ce416d422cd80b3d15bc35476fff4cddea51f498bd02109f55b99d889eb5e02

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

Filesize
72KB

MD5
8587c2085263852f2087d7a01e2d8bb3

SHA1
5cd0650ba4418bc34e9283af498e6267d6855d1a

SHA256
45a9142b8de85269bbb0c2638cf0b7cc3c99fcbce4121157b09a4284f5b413a0

SHA512
cda1f5712add7907679b95d139e6357cc69c83fc91c306900560b1d0d0e267fc6de459f891ce7d1cee79839003fc6dfbd7d92cf4ab62da0ba235d56bce38a52a

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
6fc942acfab1271f77c94568d307647e

SHA1
51a48f69acd3b0b71ae9b3e6366cbfbf35612ec8

SHA256
f67b908fc49bc14fca33822012b909252584f5b2eada41c192b3c86606fcbaf5

SHA512
f21e670ba85a32e05a3c28bf79c4f1a8e71d4732e113ffa42b4df5581b7c83b9f2dfbe3703eb89ff29ec13daaf1e46693e7d7e204bd5be6f627d9c8d9ab8ec6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\34134747\System Restore.exe

Filesize
72KB

MD5
7b618f2c9e2da8d78fa90b02a7ecd932

SHA1
a551b966030736e814399a35fdb16ddc0fa51f54

SHA256
0d24172ff34a32526372f114199c0aaf63d522a2ed8770bd3b0ee55f40c2fd67

SHA512
cefc81c5e565119f6fc1a955731e79e347951578385632f04908b79fb75e05192710bffd8b965fe4c5a57417589931d3a1e6e4109ad2fab8862acc98217e1b91

Download Submit
C:\backup.exe

Filesize
72KB

MD5
96b905c71e3c43c76d71405f89da3f86

SHA1
af3568ba44f09d78b1cc4c8d1600047ea52e3dce

SHA256
b1f72ed09536bf470817e95a660087f651ceb46c90b51fb20147be89c305ac4f

SHA512
eef73d89546181374c26e83e791bf41cf91785f1176aee379583f81f632ae887a2d141aabf4c0bf350a8a01c9aed2e0f9c0fe62e05681fb811faad14fe162d52

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads