547bb04a621bae69a3fed7e4b7b000f883b1addada703d8461d058b31d52b510

Analysis

max time kernel
0s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c6a23ac956a227c6005e05964ab068b.exe
Size

72KB
MD5

4c6a23ac956a227c6005e05964ab068b
SHA1

256ed0ada1bdd1b04fc86572476b70d8b23825a3
SHA256

547bb04a621bae69a3fed7e4b7b000f883b1addada703d8461d058b31d52b510
SHA512

499290837e728b8ff5e979960af0aa5146b9bd8ca4cbd2147947a9018143112d6b4eed359770ff84a7f051317cf9cafc7f79dd3a6633b313f4f428e5014f65ab
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2z:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr/

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found

Executes dropped EXE 3 IoCs

pid	Process
2860	Process not Found
2668	Process not Found
2728	Process not Found

Loads dropped DLL 6 IoCs

pid	Process
2336	backup.exe
2336	backup.exe
2336	backup.exe
2336	backup.exe
2336	backup.exe
2336	backup.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2336	backup.exe
2860	Process not Found
2668	Process not Found

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2860	2336	backup.exe	1050
PID 2336 wrote to memory of 2860	2336	backup.exe	1050
PID 2336 wrote to memory of 2860	2336	backup.exe	1050
PID 2336 wrote to memory of 2860	2336	backup.exe	1050
PID 2336 wrote to memory of 2668	2336	backup.exe	1049
PID 2336 wrote to memory of 2668	2336	backup.exe	1049
PID 2336 wrote to memory of 2668	2336	backup.exe	1049
PID 2336 wrote to memory of 2668	2336	backup.exe	1049
PID 2336 wrote to memory of 2728	2336	backup.exe	1048
PID 2336 wrote to memory of 2728	2336	backup.exe	1048
PID 2336 wrote to memory of 2728	2336	backup.exe	1048
PID 2336 wrote to memory of 2728	2336	backup.exe	1048

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\4c6a23ac956a227c6005e05964ab068b.exe
"C:\Users\Admin\AppData\Local\Temp\4c6a23ac956a227c6005e05964ab068b.exe"
1⤵
PID:2336
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe
  "C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  PID:2964
- - C:\Program Files\Mozilla Firefox\browser\features\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
    3⤵
    PID:604
  - - C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
      4⤵
      PID:1572
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
        5⤵
        
        PID:2832
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
        5⤵
        
        PID:2696
- - C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
    "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
    3⤵
    PID:1888
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
      4⤵
      PID:2508
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        
        PID:268
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\
      4⤵
      PID:1928
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\
      4⤵
      PID:576
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\
      4⤵
      PID:1632
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\
      4⤵
      PID:2328
- C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe
  C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\
  2⤵
  PID:1720
- - C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
    3⤵
    PID:2212
- C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
  2⤵
  PID:2512

C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\
1⤵
PID:2832

C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
1⤵
PID:2492
- C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
  2⤵
  PID:1120
- C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
  2⤵
  PID:960
- C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
  2⤵
  PID:400
- - C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
    3⤵
    PID:2056
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
  2⤵
  PID:1044
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
    3⤵
    PID:2544
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
    3⤵
    PID:2564
- - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
    3⤵
    PID:2440
  - - C:\Program Files\Google\Chrome\backup.exe
      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
      4⤵
      PID:2720
  - - C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
      4⤵
      PID:1880
- C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
  2⤵
  PID:2648
- C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
  2⤵
  PID:2676
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
    3⤵
    PID:2588
- C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
  2⤵
  PID:1600
- C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
  2⤵
  PID:896
- C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
  2⤵
  PID:572
- C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
  2⤵
  PID:1228

C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
1⤵
PID:1468

C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
1⤵
PID:904

C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
1⤵
PID:2804

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2608
- C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\
  2⤵
  PID:1416
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
    3⤵
    PID:1972
  - - C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
      4⤵
      PID:2580
  - - C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\
      4⤵
      PID:2532
  - - C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
      4⤵
      PID:2592
  - - C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
      4⤵
      PID:2804
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
    3⤵
    PID:2564
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
    3⤵
    PID:2532
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
    3⤵
    PID:2592
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\data.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
    3⤵
    PID:2124

C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
1⤵
PID:2832
- C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
  "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
  2⤵
  PID:2068
- - C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
    3⤵
    PID:2852
- - C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
    3⤵
    PID:1376
- C:\Program Files\Common Files\System\Ole DB\ja-JP\update.exe
  "C:\Program Files\Common Files\System\Ole DB\ja-JP\update.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
  2⤵
  PID:2844
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
  2⤵
  PID:1900

C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
1⤵
PID:2420

C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
1⤵
PID:1368

C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
1⤵
PID:1928

C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
1⤵
PID:824

C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
1⤵
PID:580

C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
1⤵
PID:2988

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:1188

C:\Program Files\Common Files\System\ado\de-DE\backup.exe
"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
1⤵
PID:976
- C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
  2⤵
  PID:1284

C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe
"C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\ado\fr-FR\
1⤵
PID:1416
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
  2⤵
  PID:916

C:\Program Files\Common Files\System\de-DE\backup.exe
"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
1⤵
PID:1948

C:\Program Files\Common Files\System\ja-JP\backup.exe
"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
1⤵
PID:2484

C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
1⤵
PID:2564

C:\Program Files\Common Files\System\msadc\fr-FR\update.exe
"C:\Program Files\Common Files\System\msadc\fr-FR\update.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
1⤵
PID:1724

C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
1⤵
PID:2756

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:640

C:\Program Files\DVD Maker\ja-JP\backup.exe
"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
1⤵
PID:1992

C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
1⤵
PID:1788
- C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
  2⤵
  PID:788
- C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
  2⤵
  PID:1912
- C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\update.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
  2⤵
  PID:1608
- C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
  2⤵
  PID:1728
- C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
  2⤵
  PID:1936
- C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
  2⤵
  PID:2672
- C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
  2⤵
  PID:2660

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
1⤵
PID:1044

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
1⤵
PID:2420

C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
1⤵
PID:1616

C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
1⤵
PID:600

C:\Program Files\Internet Explorer\de-DE\backup.exe
"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
1⤵
PID:3048

C:\Program Files\Internet Explorer\fr-FR\backup.exe
"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
1⤵
PID:1736

C:\Program Files\Java\jdk1.7.0_80\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
1⤵
PID:3044
- C:\Program Files\Java\jdk1.7.0_80\db\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\db\
  2⤵
  PID:1796
- - C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
    3⤵
    PID:1228
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
    3⤵
    PID:772
- - C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
    3⤵
    PID:1904
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
      4⤵
      PID:2992
    - - C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
        5⤵
        
        PID:1624
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
      4⤵
      PID:2108
- - C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\
    3⤵
    PID:2328
- - C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\update.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
    3⤵
    PID:2180
- - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
    3⤵
    PID:1732
  - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\
      4⤵
      PID:2780
- - C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
    3⤵
    PID:3036
- - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
    3⤵
    PID:2972
  - - C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\System Restore.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
      4⤵
      PID:1940
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
        5⤵
        
        PID:1072
- - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\
    3⤵
    PID:2692
  - - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\
      4⤵
      PID:1900
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
        5⤵
        
        PID:2200
    - - C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
        5⤵
        
        PID:2020
  - - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\
      4⤵
      PID:2560
    - - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
        5⤵
        
        PID:2764
  - - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\data.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
      4⤵
      PID:3008
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
    3⤵
    PID:2472
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\
      4⤵
      PID:2396
- - C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VBA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
    3⤵
    PID:2012
- - C:\Program Files (x86)\Common Files\microsoft shared\VC\System Restore.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VC\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\
    3⤵
    PID:2828
- - C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
    3⤵
    PID:2804
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\
    3⤵
    PID:944
  - - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\
      4⤵
      PID:1668
    - - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\update.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\
        5⤵
        
        PID:2496
  - - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\System Restore.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\
      4⤵
      PID:2580
  - - C:\Program Files\MSBuild\Microsoft\backup.exe
      "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
      4⤵
      PID:1792
- - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
    3⤵
    PID:2932
- - C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\
    3⤵
    PID:1000
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
    3⤵
    PID:2596
  - - C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
      4⤵
      PID:3000
- - C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\
    3⤵
    PID:1764
  - - C:\Program Files\Microsoft Games\Solitaire\backup.exe
      "C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
      4⤵
      PID:1972
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
        5⤵
        
        PID:1416
  - - C:\Program Files\Microsoft Games\Multiplayer\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
      4⤵
      PID:2980
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
        5⤵
        
        PID:2640
  - - C:\Program Files\Microsoft Games\More Games\backup.exe
      "C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\
      4⤵
      PID:648
  - - C:\Program Files\Microsoft Games\Minesweeper\backup.exe
      "C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\
      4⤵
      PID:2140
  - - C:\Program Files\Microsoft Games\Hearts\data.exe
      "C:\Program Files\Microsoft Games\Hearts\data.exe" C:\Program Files\Microsoft Games\Hearts\
      4⤵
      PID:1588
  - - C:\Program Files\Microsoft Games\FreeCell\backup.exe
      "C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
      4⤵
      PID:1428
  - - C:\Program Files\Microsoft Games\Chess\backup.exe
      "C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
      4⤵
      PID:2424
- - C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\
    3⤵
    PID:2216
- - C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
    3⤵
    PID:2600
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
    3⤵
    PID:2444
- - C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\
    3⤵
    PID:572
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
    3⤵
    PID:1744
- - C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
    3⤵
    PID:1732
- - C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
    3⤵
    PID:1520
- - C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
    3⤵
    PID:2792
- - C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
    3⤵
    PID:2428
- - C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
    3⤵
    PID:2536
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
      4⤵
      PID:1920

C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
1⤵
PID:3052
- C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
  2⤵
  PID:696

C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
1⤵
PID:848
- C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\
  2⤵
  PID:928

C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
1⤵
PID:2564

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
1⤵
PID:3000

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
1⤵
PID:2980
- C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
  2⤵
  PID:1452
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
    3⤵
    PID:2916
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
    3⤵
    PID:1860
  - - C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
      4⤵
      PID:1288
    - - C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\
        5⤵
        
        PID:1192
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
        6⤵
        
        PID:1932
        
        C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
        7⤵
        
        PID:1684
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
        8⤵
        
        PID:2392
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\update.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\
  2⤵
  PID:1840
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
    3⤵
    PID:1564
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
    3⤵
    PID:2612
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
    3⤵
    PID:356
- C:\Program Files\Microsoft Games\Multiplayer\Backgammon\data.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\data.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
  2⤵
  PID:1888

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
1⤵
PID:1564
- C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
  "C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
  2⤵
  PID:1252
- - C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe
    "C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
    3⤵
    PID:2020
- - C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
    3⤵
    PID:2136

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
1⤵
PID:1880

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
1⤵
PID:896

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\update.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
1⤵
PID:2260

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
1⤵
PID:2300

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
1⤵
PID:2448

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
1⤵
PID:1120

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
1⤵
PID:376
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
  2⤵
  PID:2492
- - C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
    3⤵
    PID:772
- - C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
    3⤵
    PID:1232
- - C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
    3⤵
    PID:1280
- - C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
    3⤵
    PID:1856
- - C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
    3⤵
    PID:2252
- - C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
    3⤵
    PID:2976
- - C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
    3⤵
    PID:1932
- - C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
    3⤵
    PID:484
- - C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
    3⤵
    PID:1020
- - C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
    3⤵
    PID:2944
- - C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
    3⤵
    PID:944
- - C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
    3⤵
    PID:1680
- - C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
    3⤵
    PID:2056
- - C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
    3⤵
    PID:268
- - C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
    3⤵
    PID:1504
- - C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
    3⤵
    PID:1572
- - C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
    3⤵
    PID:1928
- - C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
    3⤵
    PID:2588
- - C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
    3⤵
    PID:2884
- - C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
    3⤵
    PID:1056
- - C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
    3⤵
    PID:1968
- - C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
    3⤵
    PID:696
- - C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
    3⤵
    PID:3052
- - C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
    3⤵
    PID:1568
- - C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
    3⤵
    PID:1732
- - C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
    3⤵
    PID:1856
- - C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
    3⤵
    PID:1800

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
1⤵
PID:1668
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\data.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
  2⤵
  PID:1936
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
  2⤵
  PID:2656
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
  2⤵
  PID:2752
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
  2⤵
  PID:1904
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
  2⤵
  PID:2872
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
  2⤵
  PID:1684
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
  2⤵
  PID:2448

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:1624

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
1⤵
PID:2720
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
  2⤵
  PID:2224
- C:\Program Files\Windows Defender\en-US\backup.exe
  "C:\Program Files\Windows Defender\en-US\backup.exe" C:\Program Files\Windows Defender\en-US\
  2⤵
  PID:3040
- C:\Program Files\Windows Defender\fr-FR\backup.exe
  "C:\Program Files\Windows Defender\fr-FR\backup.exe" C:\Program Files\Windows Defender\fr-FR\
  2⤵
  PID:2264
- C:\Program Files\Windows Defender\ja-JP\backup.exe
  "C:\Program Files\Windows Defender\ja-JP\backup.exe" C:\Program Files\Windows Defender\ja-JP\
  2⤵
  PID:2124
- C:\Program Files\Windows Defender\it-IT\backup.exe
  "C:\Program Files\Windows Defender\it-IT\backup.exe" C:\Program Files\Windows Defender\it-IT\
  2⤵
  PID:2472
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\
    3⤵
    PID:2456
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\
    3⤵
    PID:2068
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\
    3⤵
    PID:2112
  - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
      "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
      4⤵
      PID:2392
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
        5⤵
        
        PID:1212
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\
    3⤵
    PID:2020
- - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\
    3⤵
    PID:2316
- C:\Program Files\Windows Defender\es-ES\update.exe
  "C:\Program Files\Windows Defender\es-ES\update.exe" C:\Program Files\Windows Defender\es-ES\
  2⤵
  PID:2908
- C:\Program Files\Windows Defender\de-DE\backup.exe
  "C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
  2⤵
  PID:2180
- - C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
    3⤵
    PID:788
- - C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\
    3⤵
    PID:2016

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
1⤵
PID:2912

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\update.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\
1⤵
PID:3056

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
1⤵
PID:2812
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
  2⤵
  PID:1960

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
1⤵
PID:2752

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
1⤵
PID:1604

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
1⤵
PID:3004

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
1⤵
PID:2872
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
  2⤵
  PID:2792
- - C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
    "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
    3⤵
    PID:2828
- - C:\Program Files\Common Files\System\msadc\es-ES\update.exe
    "C:\Program Files\Common Files\System\msadc\es-ES\update.exe" C:\Program Files\Common Files\System\msadc\es-ES\
    3⤵
    PID:2384
- - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
    3⤵
    PID:3000

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
1⤵
PID:1592

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
1⤵
PID:1572
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
  2⤵
  PID:880

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
1⤵
PID:1840
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
  2⤵
  PID:1220
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\
  2⤵
  PID:944
- - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\
    3⤵
    PID:2084
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
  2⤵
  PID:1064
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\
  2⤵
  PID:2016
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\
  2⤵
  PID:1900
- C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\
  2⤵
  PID:3024

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
1⤵
PID:1424

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
1⤵
PID:3016
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
  2⤵
  PID:2300
- C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
  2⤵
  PID:2380

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
1⤵
PID:2392

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
1⤵
PID:1288
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
  2⤵
  PID:972
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
  2⤵
  PID:320

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
1⤵
PID:376
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
  2⤵
  PID:2276
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
  2⤵
  PID:1448
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\
    3⤵
    PID:2284
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
    3⤵
    PID:2216
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
  2⤵
  PID:2708
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
    3⤵
    PID:1580

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
1⤵
PID:2796
- C:\Program Files (x86)\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:328
- - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
    3⤵
    PID:1452
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
      4⤵
      PID:1888
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
        5⤵
        
        PID:2496
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
        5⤵
        
        PID:2544
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
        6⤵
        
        PID:1788
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
        7⤵
        
        PID:1904
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
        8⤵
        
        PID:1524
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
        7⤵
        
        PID:2580
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
        7⤵
        
        PID:2484
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
        7⤵
        
        PID:1920
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
        7⤵
        
        PID:1908
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
        7⤵
        
        PID:1948
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
        7⤵
        
        PID:2252
        
        C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
        8⤵
        
        PID:1972
        
        C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        8⤵
        
        PID:3052
        
        C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        8⤵
        
        PID:1228
        
        C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        8⤵
        
        PID:1280
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
        7⤵
        
        PID:960
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
        7⤵
        
        PID:2012
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
        7⤵
        
        PID:2248
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\update.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
        7⤵
        
        PID:2928
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
        7⤵
        
        PID:2496
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
        7⤵
        
        PID:876
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
        7⤵
        
        PID:1212
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
        7⤵
        
        PID:1460
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
      4⤵
      PID:2460
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
        5⤵
        
        PID:2212
    - - C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
        5⤵
        
        PID:2844
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:400
- - C:\Program Files (x86)\Google\CrashReports\backup.exe
    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
    3⤵
    PID:820
- - C:\Program Files (x86)\Google\Temp\backup.exe
    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
    3⤵
    PID:2804
- - C:\Program Files (x86)\Google\Update\backup.exe
    "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
    3⤵
    PID:844
  - - C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\js\
      4⤵
      PID:2832
  - - C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\images\
      4⤵
      PID:896
  - - C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\http\dialogs\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
      4⤵
      PID:1416
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:2700
- - C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
    3⤵
    PID:1164
- - C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
    "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
    3⤵
    PID:1996
- - C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
    "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
    3⤵
    PID:2136
- C:\Program Files (x86)\Common Files\backup.exe
  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\System Restore.exe" C:\Program Files (x86)\Microsoft Analysis Services\
  2⤵
  PID:628

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
1⤵
PID:2652
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
  2⤵
  PID:2764

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
1⤵
PID:2996
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
  2⤵
  PID:1044
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\
  2⤵
  PID:2700
- - C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
    3⤵
    PID:2508
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
  2⤵
  PID:2776
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
    3⤵
    PID:2588

C:\Program Files\Java\jre7\lib\applet\backup.exe
"C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
1⤵
PID:2740

C:\Program Files\Java\jre7\lib\deploy\backup.exe
"C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\
1⤵
PID:2156

C:\Program Files\Java\jre7\lib\images\cursors\backup.exe
"C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\
1⤵
PID:1576

C:\Program Files\Java\jre7\lib\management\backup.exe
"C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
1⤵
PID:792

C:\Program Files\Java\jre7\lib\zi\backup.exe
"C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
1⤵
PID:1060
- C:\Program Files\Java\jre7\lib\zi\America\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
  2⤵
  PID:2320
- - C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
    3⤵
    PID:1844
- - C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
    3⤵
    PID:2276
  - - C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
      4⤵
      PID:2576
- - C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
    3⤵
    PID:1416
- - C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2336
- C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
  2⤵
  PID:2572
- C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
  2⤵
  PID:2536
- C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
  2⤵
  PID:3008
- - C:\Program Files\VideoLAN\VLC\backup.exe
    "C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
    3⤵
    PID:2344
  - - C:\Program Files\VideoLAN\VLC\locale\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
      4⤵
      PID:2856
    - - C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
        5⤵
        
        PID:2648
      - C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
        6⤵
        
        PID:1520
    - - C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
        5⤵
        
        PID:1616
    - - C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
        5⤵
        
        PID:1900
    - - C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
        5⤵
        
        PID:1932
    - - C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
        5⤵
        
        PID:2920
    - - C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
        5⤵
        
        PID:2904
      - C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\
        6⤵
        
        PID:2684
    - - C:\Program Files\VideoLAN\VLC\locale\el\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\el\update.exe" C:\Program Files\VideoLAN\VLC\locale\el\
        5⤵
        
        PID:796
      - C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\
        6⤵
        
        PID:2448
    - - C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
        5⤵
        
        PID:972
      - C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
        6⤵
        
        PID:776
    - - C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\
        5⤵
        
        PID:1564
      - C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
        6⤵
        
        PID:1064
    - - C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ia\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\
        5⤵
        
        PID:2224
      - C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\
        6⤵
        
        PID:2200
    - - C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
        5⤵
        
        PID:484
      - C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
        6⤵
        
        PID:2448
    - - C:\Program Files\VideoLAN\VLC\locale\lg\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lg\data.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
        5⤵
        
        PID:2988
      - C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
        6⤵
        
        PID:2464
        
        C:\Program Files (x86)\Common Files\System\ado\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
        7⤵
        
        PID:2972
        
        C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
        8⤵
        
        PID:2396
        
        C:\Program Files (x86)\Common Files\System\ado\en-US\update.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\en-US\update.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
        8⤵
        
        PID:1580
        
        C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
        8⤵
        
        PID:2068
        
        C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
        8⤵
        
        PID:268
        
        C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
        8⤵
        
        PID:2632
        
        C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
        8⤵
        
        PID:824
        
        C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
        8⤵
        
        PID:1040
        
        C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\
        8⤵
        
        PID:560
        
        C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\
        8⤵
        
        PID:1856
        
        C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
        8⤵
        
        PID:2916
        
        C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
        9⤵
        
        PID:1480
        
        C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\
        8⤵
        
        PID:1996
        
        C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\update.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
        8⤵
        
        PID:1636
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
        8⤵
        
        PID:3044
        
        C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
        9⤵
        
        PID:1912
        
        C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
        9⤵
        
        PID:2004
        
        C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
        9⤵
        
        PID:916
        
        C:\Program Files\Java\jdk1.7.0_80\bin\data.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\bin\data.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
        9⤵
        
        PID:1480
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
        8⤵
        
        PID:2968
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
        8⤵
        
        PID:332
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
        8⤵
        
        PID:1800
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        8⤵
        
        PID:1256
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        8⤵
        
        PID:824
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        8⤵
        
        PID:2696
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        8⤵
        
        PID:2420
        
        C:\Program Files\Microsoft Office\Office14\backup.exe
        
        "C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
        9⤵
        
        PID:2884
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        8⤵
        
        PID:1884
      - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
        6⤵
        
        PID:2156
    - - C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
        5⤵
        
        PID:2316
      - C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\
        6⤵
        
        PID:2536
        
        C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\System Restore.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
        7⤵
        
        PID:1504
    - - C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
        5⤵
        
        PID:1608
      - C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
        6⤵
        
        PID:792
        
        C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\
        7⤵
        
        PID:1320
      - C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
        6⤵
        
        PID:2272
        
        C:\Users\Public\Recorded TV\backup.exe
        
        "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
        7⤵
        
        PID:2124
        
        C:\Users\Public\Videos\backup.exe
        
        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
        7⤵
        
        PID:1884
    - - C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
        5⤵
        
        PID:2420
      - C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
        6⤵
        
        PID:1048
    - - C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\
        5⤵
        
        PID:2448
      - C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\
        6⤵
        
        PID:2136
    - - C:\Program Files\VideoLAN\VLC\locale\tet\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\tet\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\
        5⤵
        
        PID:2236
      - C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\
        6⤵
        
        PID:1980
        
        C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\data.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
        7⤵
        
        PID:1212
        
        C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
        7⤵
        
        PID:2392
        
        C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
        7⤵
        
        PID:1684
        
        C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
        7⤵
        
        PID:1996
        
        C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
        7⤵
        
        PID:2352
        
        C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
        7⤵
        
        PID:712
        
        C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
        7⤵
        
        PID:2844
    - - C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\
        5⤵
        
        PID:2284
      - C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
        6⤵
        
        PID:1232
    - - C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\
        5⤵
        
        PID:2252
    - - C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\
        5⤵
        
        PID:2996
      - C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\
        6⤵
        
        PID:1756
      - C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
        6⤵
        
        PID:880
    - - C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\
        5⤵
        
        PID:3012
      - C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\
        6⤵
        
        PID:2740
      - C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
        6⤵
        
        PID:2380
    - - C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\
        5⤵
        
        PID:1968
      - C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\
        6⤵
        
        PID:2004
      - C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
        6⤵
        
        PID:1664
      - C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
        6⤵
        
        PID:3028
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
        7⤵
        
        PID:2152
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
        7⤵
        
        PID:1940
      - C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
        6⤵
        
        PID:2136
      - C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
        6⤵
        
        PID:3020
    - - C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\
        5⤵
        
        PID:1288
    - - C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\
        5⤵
        
        PID:2908
    - - C:\Program Files\VideoLAN\VLC\locale\uz\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\uz\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\
        5⤵
        
        PID:2992
    - - C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\
        5⤵
        
        PID:2976
      - C:\Program Files\Common Files\System\Ole DB\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
        6⤵
        
        PID:2832
      - C:\Program Files\Common Files\System\msadc\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
        6⤵
        
        PID:2792
      - C:\Program Files\Common Files\System\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
        6⤵
        
        PID:2672
      - C:\Program Files\Common Files\System\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
        6⤵
        
        PID:2952
      - C:\Program Files\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
        6⤵
        
        PID:1216
      - C:\Program Files\Common Files\System\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
        6⤵
        
        PID:1936
      - C:\Program Files\Common Files\System\ado\backup.exe
        
        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
        6⤵
        
        PID:2252
    - - C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
        5⤵
        
        PID:2608
    - - C:\Program Files\VideoLAN\VLC\locale\th\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\th\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\
        5⤵
        
        PID:848
      - C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\
        6⤵
        
        PID:2396
      - C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
        6⤵
        
        PID:2664
      - C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
        6⤵
        
        PID:2472
    - - C:\Program Files\VideoLAN\VLC\locale\te\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\te\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\
        5⤵
        
        PID:1280
    - - C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\
        5⤵
        
        PID:692
    - - C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\
        5⤵
        
        PID:2836
    - - C:\Program Files\VideoLAN\VLC\locale\sr\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\sr\update.exe" C:\Program Files\VideoLAN\VLC\locale\sr\
        5⤵
        
        PID:976
    - - C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\
        5⤵
        
        PID:1592
    - - C:\Program Files\VideoLAN\VLC\locale\sl\System Restore.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\sl\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\sl\
        5⤵
        
        PID:2828
    - - C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
        5⤵
        
        PID:2956
    - - C:\Program Files\VideoLAN\VLC\locale\si\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\si\data.exe" C:\Program Files\VideoLAN\VLC\locale\si\
        5⤵
        
        PID:2412
    - - C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
        5⤵
        
        PID:792
    - - C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
        5⤵
        
        PID:1876
      - C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
        6⤵
        
        PID:2908
    - - C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\
        5⤵
        
        PID:2916
    - - C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
        5⤵
        
        PID:2696
    - - C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
        5⤵
        
        PID:2888
    - - C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
        5⤵
        
        PID:2864
    - - C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\oc\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
        5⤵
        
        PID:2536
    - - C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
        5⤵
        
        PID:2564
    - - C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\
        5⤵
        
        PID:2248
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
        6⤵
        
        PID:2056
    - - C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
        5⤵
        
        PID:2448
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
        6⤵
        
        PID:1288
    - - C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
        5⤵
        
        PID:1876
    - - C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
        5⤵
        
        PID:1116
      - C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
        6⤵
        
        PID:1072
      - C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
        6⤵
        
        PID:1924
      - C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
        6⤵
        
        PID:1740
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
        6⤵
        
        PID:1036
      - C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
        6⤵
        
        PID:1724
      - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
        6⤵
        
        PID:2560
      - C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
        6⤵
        
        PID:2196
      - C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
        6⤵
        
        PID:1628
    - - C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
        5⤵
        
        PID:2460
    - - C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
        5⤵
        
        PID:1632
    - - C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
        5⤵
        
        PID:2792
    - - C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\mk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
        5⤵
        
        PID:2140
      - C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
        6⤵
        
        PID:2564
      - C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
        6⤵
        
        PID:2532
      - C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
        6⤵
        
        PID:2796
        
        C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
        7⤵
        
        PID:2924
        
        C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
        
        "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
        7⤵
        
        PID:3032
        
        C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
        
        "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
        7⤵
        
        PID:2156
      - C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
        6⤵
        
        PID:2664
      - C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
        6⤵
        
        PID:916
    - - C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\
        5⤵
        
        PID:2252
    - - C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\
        5⤵
        
        PID:1320
    - - C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ky\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
        5⤵
        
        PID:2716
    - - C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ks_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\
        5⤵
        
        PID:856
    - - C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\
        5⤵
        
        PID:692
    - - C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\
        5⤵
        
        PID:2700
      - C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
        6⤵
        
        PID:1060
        
        C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
        7⤵
        
        PID:2672
        
        C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe" C:\Program Files\Java\jre7\lib\zi\Europe\
        7⤵
        
        PID:2284
        
        C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
        7⤵
        
        PID:328
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
        8⤵
        
        PID:1972
        
        C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
        7⤵
        
        PID:2944
        
        C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
        7⤵
        
        PID:2656
        
        C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
        
        "C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
        7⤵
        
        PID:1496
      - C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
        6⤵
        
        PID:2456
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
        6⤵
        
        PID:2584
      - C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
        6⤵
        
        PID:856
      - C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
        6⤵
        
        PID:2240
    - - C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
        5⤵
        
        PID:1036
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
        6⤵
        
        PID:1616
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
        6⤵
        
        PID:1884
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
        6⤵
        
        PID:2068
      - C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
        6⤵
        
        PID:2724
    - - C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\
        5⤵
        
        PID:2640
    - - C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
        5⤵
        
        PID:1920
    - - C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
        5⤵
        
        PID:2396
    - - C:\Program Files\VideoLAN\VLC\locale\it\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\
        5⤵
        
        PID:400
    - - C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
        5⤵
        
        PID:1608
    - - C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hy\
        5⤵
        
        PID:2180
    - - C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\
        5⤵
        
        PID:2836
    - - C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\
        5⤵
        
        PID:2068
    - - C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
        5⤵
        
        PID:2556
    - - C:\Program Files\VideoLAN\VLC\locale\he\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\
        5⤵
        
        PID:772
    - - C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\
        5⤵
        
        PID:2336
    - - C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
        5⤵
        
        PID:2276
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
        6⤵
        
        PID:2240
    - - C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
        5⤵
        
        PID:2280
    - - C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
        5⤵
        
        PID:1860
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
        6⤵
        
        PID:1980
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
        6⤵
        
        PID:852
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\
        6⤵
        
        PID:2192
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
        6⤵
        
        PID:2584
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
        6⤵
        
        PID:2956
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
        6⤵
        
        PID:2596
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\update.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
        6⤵
        
        PID:3008
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
        6⤵
        
        PID:2532
    - - C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
        5⤵
        
        PID:3016
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
        6⤵
        
        PID:3012
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
        7⤵
        
        PID:2260
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        
        PID:3012
    - - C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
        5⤵
        
        PID:2568
    - - C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\
        5⤵
        
        PID:2820
    - - C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ff\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
        5⤵
        
        PID:2888
    - - C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
        5⤵
        
        PID:2596
    - - C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\eu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
        5⤵
        
        PID:288
    - - C:\Program Files\VideoLAN\VLC\locale\et\update.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\et\update.exe" C:\Program Files\VideoLAN\VLC\locale\et\
        5⤵
        
        PID:2904
      - C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
        6⤵
        
        PID:792
        
        C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\it-IT\backup.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\
        7⤵
        
        PID:2004
        
        C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
        8⤵
        
        PID:1860
        
        C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
        7⤵
        
        PID:2136
        
        C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
        7⤵
        
        PID:1668
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
        8⤵
        
        PID:2868
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
        8⤵
        
        PID:1168
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
        8⤵
        
        PID:3012
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
        8⤵
        
        PID:268
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
        8⤵
        
        PID:784
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
        8⤵
        
        PID:2832
        
        C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
        9⤵
        
        PID:1564
        
        C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
        9⤵
        
        PID:1616
        
        C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
        9⤵
        
        PID:2612
        
        C:\Program Files\Common Files\System\Ole DB\en-US\update.exe
        
        "C:\Program Files\Common Files\System\Ole DB\en-US\update.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
        9⤵
        
        PID:2420
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
        8⤵
        
        PID:2848
        
        C:\Program Files\Windows Media Player\Media Renderer\backup.exe
        
        "C:\Program Files\Windows Media Player\Media Renderer\backup.exe" C:\Program Files\Windows Media Player\Media Renderer\
        9⤵
        
        PID:1460
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
        8⤵
        
        PID:2676
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\
        8⤵
        
        PID:1592
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
        8⤵
        
        PID:2344
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
        8⤵
        
        PID:2992
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
        8⤵
        
        PID:2396
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\data.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
        8⤵
        
        PID:2316
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
        8⤵
        
        PID:2208
        
        C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
        8⤵
        
        PID:916
    - - C:\Program Files\VideoLAN\VLC\locale\es\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\
        5⤵
        
        PID:1748
    - - C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
        5⤵
        
        PID:3012
    - - C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
        5⤵
        
        PID:1172
    - - C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
        5⤵
        
        PID:2996
      - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
        6⤵
        
        PID:1928
    - - C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
        5⤵
        
        PID:2192
    - - C:\Program Files\VideoLAN\VLC\locale\co\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\
        5⤵
        
        PID:2068
    - - C:\Program Files\VideoLAN\VLC\locale\ckb\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ckb\data.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\
        5⤵
        
        PID:808
    - - C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
        5⤵
        
        PID:2548
    - - C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
        5⤵
        
        PID:2472
    - - C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
        5⤵
        
        PID:1716
    - - C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
        5⤵
        
        PID:1568
    - - C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\
        5⤵
        
        PID:1576
    - - C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
        5⤵
        
        PID:1192
    - - C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
        5⤵
        
        PID:2200
    - - C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
        5⤵
        
        PID:2440
    - - C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
        5⤵
        
        PID:604
    - - C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
        5⤵
        
        PID:1720
    - - C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
        5⤵
        
        PID:2992
  - - C:\Program Files\VideoLAN\VLC\plugins\backup.exe
      "C:\Program Files\VideoLAN\VLC\plugins\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\
      4⤵
      PID:2552
    - - C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\codec\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\codec\
        5⤵
        
        PID:1756
    - - C:\Program Files\VideoLAN\VLC\plugins\control\update.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\control\update.exe" C:\Program Files\VideoLAN\VLC\plugins\control\
        5⤵
        
        PID:1636
    - - C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\audio_output\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_output\
        5⤵
        
        PID:2888
    - - C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\d3d9\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d9\
        5⤵
        
        PID:2820
      - C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\intf\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\modules\
        6⤵
        
        PID:2020
    - - C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\demux\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\demux\
        5⤵
        
        PID:892
    - - C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\gui\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\gui\
        5⤵
        
        PID:2152
    - - C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\d3d11\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\d3d11\
        5⤵
        
        PID:1424
    - - C:\Program Files\VideoLAN\VLC\plugins\keystore\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\keystore\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\keystore\
        5⤵
        
        PID:2952
    - - C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\logger\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\logger\
        5⤵
        
        PID:576
    - - C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\lua\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\lua\
        5⤵
        
        PID:2380
    - - C:\Program Files\VideoLAN\VLC\plugins\meta_engine\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\meta_engine\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\meta_engine\
        5⤵
        
        PID:1372
    - - C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\misc\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\misc\
        5⤵
        
        PID:560
    - - C:\Program Files\VideoLAN\VLC\plugins\mux\data.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\data.exe" C:\Program Files\VideoLAN\VLC\plugins\mux\
        5⤵
        
        PID:1376
    - - C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\packetizer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\packetizer\
        5⤵
        
        PID:2424
      - C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
        6⤵
        
        PID:2212
      - C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\
        6⤵
        
        PID:2776
      - C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
        6⤵
        
        PID:852
  - - C:\Program Files\VideoLAN\VLC\lua\backup.exe
      "C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
      4⤵
      PID:2280
  - - C:\Program Files\VideoLAN\VLC\skins\backup.exe
      "C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
      4⤵
      PID:2912
  - - C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
      "C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
      4⤵
      PID:2816
- C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
  2⤵
  PID:2852

C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
1⤵
PID:2888
- C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
  2⤵
  PID:1036
- - C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
    3⤵
    PID:1616
  - - C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
      4⤵
      PID:2584
- C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
  2⤵
  PID:268

C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
1⤵
PID:2540

C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
1⤵
PID:2884
- C:\Program Files\Microsoft Office\Office14\1033\backup.exe
  "C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
  2⤵
  PID:2328

C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
1⤵
PID:1172
- C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
  "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
  2⤵
  PID:1880
- C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
  2⤵
  PID:2000

C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
1⤵
PID:2000
- C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
  2⤵
  PID:2632

C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
1⤵
PID:2200

C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
1⤵
PID:1656

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
1⤵
PID:1072

C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
1⤵
PID:1212

C:\Program Files\Microsoft Games\Mahjong\backup.exe
"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
1⤵
PID:1968
- C:\Program Files\Microsoft Games\Mahjong\en-US\update.exe
  "C:\Program Files\Microsoft Games\Mahjong\en-US\update.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
  2⤵
  PID:776
- C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
  2⤵
  PID:1040

C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
"C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
1⤵
PID:2124

C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
1⤵
PID:2856

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
1⤵
PID:1884

C:\Program Files\Microsoft Games\Purble Place\backup.exe
"C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\
1⤵
PID:792
- C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\
  2⤵
  PID:1040
- C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
  2⤵
  PID:3028
- C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
  2⤵
  PID:1948

C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
"C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
1⤵
PID:2316

C:\Program Files\Microsoft Games\Solitaire\it-IT\data.exe
"C:\Program Files\Microsoft Games\Solitaire\it-IT\data.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\
1⤵
PID:2564
- C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
  2⤵
  PID:2572

C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
1⤵
PID:1604
- C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
  2⤵
  PID:376
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\
    3⤵
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe
      C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\
      4⤵
      PID:2996
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
    3⤵
    PID:912
- C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
  2⤵
  PID:2636
- C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
  2⤵
  PID:2648
- C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\
  2⤵
  PID:2852
- C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
  2⤵
  PID:2816
- C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
  2⤵
  PID:2344

C:\Program Files\Microsoft Office\backup.exe
"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
1⤵
PID:2420

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:2776

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
1⤵
PID:2200
- C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
  2⤵
  PID:1460

C:\Program Files\MSBuild\backup.exe
"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
1⤵
PID:944

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
1⤵
PID:2632

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:1120
- C:\Program Files\Reference Assemblies\Microsoft\update.exe
  "C:\Program Files\Reference Assemblies\Microsoft\update.exe" C:\Program Files\Reference Assemblies\Microsoft\
  2⤵
  PID:2868

C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
1⤵
PID:1736
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
  2⤵
  PID:1416
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
    3⤵
    PID:2664
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
  2⤵
  PID:1712

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
1⤵
PID:776

C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
1⤵
PID:1232

C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\
1⤵
PID:2684

C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
1⤵
PID:2032

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
1⤵
PID:2064

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
1⤵
PID:1052

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
1⤵
PID:1900

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
1⤵
PID:1232
- C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
  2⤵
  PID:1744
- - C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
    3⤵
    PID:892
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
    3⤵
    PID:2596
  - - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
      4⤵
      PID:1884
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\System Restore.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
    3⤵
    PID:1888
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\
    3⤵
    PID:1048
- - C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
    3⤵
    PID:1000

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
1⤵
PID:1664

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
1⤵
PID:928

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
1⤵
PID:1908
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
  2⤵
  PID:3064

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
1⤵
PID:2612

C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
1⤵
PID:600

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
1⤵
PID:1220

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
1⤵
PID:1328
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
  2⤵
  PID:2248
- - C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
    3⤵
    PID:972
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
      4⤵
      PID:1728

C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\data.exe
"C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
1⤵
PID:292

C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
1⤵
PID:2500

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
1⤵
PID:1060

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
1⤵
PID:1228

C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\
1⤵
PID:2696

C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
1⤵
PID:2260

C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
1⤵
PID:2800

C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
1⤵
PID:2228

C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
1⤵
PID:1748

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
1⤵
PID:2684

C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
1⤵
PID:2556

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
1⤵
PID:2268

C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
1⤵
PID:2544

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\
1⤵
PID:1580

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\update.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
1⤵
PID:1860

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\
1⤵
PID:1576

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
1⤵
PID:1436

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
1⤵
PID:1936

C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
1⤵
PID:2252

C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\
1⤵
PID:2816

C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
1⤵
PID:2952

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
1⤵
PID:1036

C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\
1⤵
PID:1932

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
1⤵
PID:1320

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
1⤵
PID:2396

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\
1⤵
PID:1556

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
1⤵
PID:1704

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\
1⤵
PID:1928

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\
1⤵
PID:2868

C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\
1⤵
PID:2820

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
1⤵
PID:1048

C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\
1⤵
PID:1496

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\
1⤵
PID:776

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
1⤵
PID:1576
- C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
  2⤵
  PID:1328

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
1⤵
PID:400

C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
1⤵
PID:772
- C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
  2⤵
  PID:2252
- - C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\
    3⤵
    PID:852
- - C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\
    3⤵
    PID:648
  - - C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
      4⤵
      PID:2460
  - - C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
      4⤵
      PID:2556
  - - C:\Program Files\Microsoft Games\More Games\es-ES\data.exe
      "C:\Program Files\Microsoft Games\More Games\es-ES\data.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
      4⤵
      PID:3064
  - - C:\Program Files\Microsoft Games\More Games\en-US\backup.exe
      "C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\
      4⤵
      PID:1688
  - - C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
      4⤵
      PID:2608

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
1⤵
PID:2484

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
1⤵
PID:2640
- C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
  2⤵
  PID:820

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\
1⤵
PID:2828

C:\Program Files\VideoLAN\VLC\lua\http\requests\System Restore.exe
"C:\Program Files\VideoLAN\VLC\lua\http\requests\System Restore.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
1⤵
PID:2508

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\
1⤵
PID:2836
- C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\
  2⤵
  PID:592

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\
1⤵
PID:1536

C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\reader\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\reader\
1⤵
PID:484

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\
1⤵
PID:2460

C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
1⤵
PID:2272

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\
1⤵
PID:1860

C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
1⤵
PID:1844

C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\access\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\access\
1⤵
PID:288
- C:\Program Files (x86)\Google\Update\Install\{816A3475-9C83-4071-ADF3-DF13B538F008}\update.exe
  "C:\Program Files (x86)\Google\Update\Install\{816A3475-9C83-4071-ADF3-DF13B538F008}\update.exe" C:\Program Files (x86)\Google\Update\Install\{816A3475-9C83-4071-ADF3-DF13B538F008}\
  2⤵
  PID:1888

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:1212
- C:\Users\Admin\data.exe
  C:\Users\Admin\data.exe C:\Users\Admin\
  2⤵
  PID:1556
- - C:\Users\Admin\Contacts\backup.exe
    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
    3⤵
    PID:2740
- - C:\Users\Admin\Desktop\backup.exe
    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
    3⤵
    PID:2632
- - C:\Users\Admin\Downloads\backup.exe
    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
    3⤵
    PID:1860
- - C:\Users\Admin\Documents\backup.exe
    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
    3⤵
    PID:1252
- - C:\Users\Admin\Links\backup.exe
    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
    3⤵
    PID:2152
- - C:\Users\Admin\Favorites\backup.exe
    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
    3⤵
    PID:1936
- - C:\Users\Admin\Music\backup.exe
    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
    3⤵
    PID:2388
- - C:\Users\Admin\Pictures\backup.exe
    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
    3⤵
    PID:2816
- - C:\Users\Admin\Videos\update.exe
    C:\Users\Admin\Videos\update.exe C:\Users\Admin\Videos\
    3⤵
    PID:2180
- - C:\Users\Admin\Searches\backup.exe
    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
    3⤵
    PID:1372
- - C:\Users\Admin\Saved Games\backup.exe
    "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
    3⤵
    PID:1472
- C:\Users\Public\backup.exe
  C:\Users\Public\backup.exe C:\Users\Public\
  2⤵
  PID:2272
- - C:\Users\Public\Documents\backup.exe
    C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
    3⤵
    PID:1744
- - C:\Users\Public\Downloads\backup.exe
    C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
    3⤵
    PID:2896
- - C:\Users\Public\Music\backup.exe
    C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
    3⤵
    PID:772
  - - C:\Users\Public\Music\Sample Music\backup.exe
      "C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\
      4⤵
      PID:2728
  - - C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
      4⤵
      PID:1504
    - - C:\Program Files\Java\jre7\lib\backup.exe
        
        "C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
        5⤵
        
        PID:712
      - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
        6⤵
        
        PID:3028
    - - C:\Program Files\Java\jre7\bin\backup.exe
        
        "C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
        5⤵
        
        PID:1564
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\System Restore.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\System Restore.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
        6⤵
        
        PID:1284
- - C:\Users\Public\Pictures\backup.exe
    C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
    3⤵
    PID:2716
  - - C:\Users\Public\Pictures\Sample Pictures\backup.exe
      "C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\
      4⤵
      PID:3040

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\
1⤵
PID:1624

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
1⤵
PID:1688

C:\Program Files\Windows Journal\en-US\backup.exe
"C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
1⤵
PID:2816

C:\Program Files\VideoLAN\VLC\plugins\access_output\System Restore.exe
"C:\Program Files\VideoLAN\VLC\plugins\access_output\System Restore.exe" C:\Program Files\VideoLAN\VLC\plugins\access_output\
1⤵
PID:300

C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_filter\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_filter\
1⤵
PID:3032

C:\Program Files\Windows Journal\fr-FR\backup.exe
"C:\Program Files\Windows Journal\fr-FR\backup.exe" C:\Program Files\Windows Journal\fr-FR\
1⤵
PID:1884

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\
1⤵
PID:2852

C:\Program Files\Windows Journal\it-IT\data.exe
"C:\Program Files\Windows Journal\it-IT\data.exe" C:\Program Files\Windows Journal\it-IT\
1⤵
PID:328

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\
1⤵
PID:1592
- C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\
  2⤵
  PID:2556
- - C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
    3⤵
    PID:2952

C:\Program Files\Windows Journal\es-ES\backup.exe
"C:\Program Files\Windows Journal\es-ES\backup.exe" C:\Program Files\Windows Journal\es-ES\
1⤵
PID:1376

C:\Program Files\Windows Journal\de-DE\backup.exe
"C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\
1⤵
PID:2672

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\
1⤵
PID:2600

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:1972
- C:\Program Files\Windows Journal\ja-JP\backup.exe
  "C:\Program Files\Windows Journal\ja-JP\backup.exe" C:\Program Files\Windows Journal\ja-JP\
  2⤵
  PID:2700
- C:\Program Files\Windows Journal\Templates\backup.exe
  "C:\Program Files\Windows Journal\Templates\backup.exe" C:\Program Files\Windows Journal\Templates\
  2⤵
  PID:2556

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\
1⤵
PID:1048
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
  2⤵
  PID:2184

C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\
1⤵
PID:2212

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\
1⤵
PID:628

C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
1⤵
PID:2808

C:\Program Files\Windows Mail\de-DE\System Restore.exe
"C:\Program Files\Windows Mail\de-DE\System Restore.exe" C:\Program Files\Windows Mail\de-DE\
1⤵
PID:1116
- C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
  2⤵
  PID:1992

C:\Program Files\Windows Mail\en-US\backup.exe
"C:\Program Files\Windows Mail\en-US\backup.exe" C:\Program Files\Windows Mail\en-US\
1⤵
PID:2924

C:\Program Files\Windows Mail\es-ES\backup.exe
"C:\Program Files\Windows Mail\es-ES\backup.exe" C:\Program Files\Windows Mail\es-ES\
1⤵
PID:2444
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
  2⤵
  PID:904
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
  2⤵
  PID:1436
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
  2⤵
  PID:2136
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
  2⤵
  PID:2516
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
  2⤵
  PID:2488

C:\Program Files\Windows Mail\fr-FR\backup.exe
"C:\Program Files\Windows Mail\fr-FR\backup.exe" C:\Program Files\Windows Mail\fr-FR\
1⤵
PID:2100

C:\Program Files\Windows Mail\backup.exe
"C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\
1⤵
PID:1256
- C:\Program Files\Windows Mail\ja-JP\backup.exe
  "C:\Program Files\Windows Mail\ja-JP\backup.exe" C:\Program Files\Windows Mail\ja-JP\
  2⤵
  PID:1036
- C:\Program Files\Windows Mail\it-IT\backup.exe
  "C:\Program Files\Windows Mail\it-IT\backup.exe" C:\Program Files\Windows Mail\it-IT\
  2⤵
  PID:916

C:\Program Files (x86)\Common Files\Services\update.exe
"C:\Program Files (x86)\Common Files\Services\update.exe" C:\Program Files (x86)\Common Files\Services\
1⤵
PID:2524

C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
"C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
1⤵
PID:1656

C:\Program Files\Windows Media Player\de-DE\backup.exe
"C:\Program Files\Windows Media Player\de-DE\backup.exe" C:\Program Files\Windows Media Player\de-DE\
1⤵
PID:876

C:\Program Files\Windows Media Player\en-US\backup.exe
"C:\Program Files\Windows Media Player\en-US\backup.exe" C:\Program Files\Windows Media Player\en-US\
1⤵
PID:1496

C:\Program Files (x86)\Google\Update\Download\backup.exe
"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
1⤵
PID:912
- C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
  2⤵
  PID:2624
- - C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe
    "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\
    3⤵
    PID:2412

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\
1⤵
PID:1728

C:\Program Files\Windows Media Player\es-ES\backup.exe
"C:\Program Files\Windows Media Player\es-ES\backup.exe" C:\Program Files\Windows Media Player\es-ES\
1⤵
PID:1252
- C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
  2⤵
  PID:1172
- - C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\
    3⤵
    PID:2740

C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\
1⤵
PID:352
- C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\
  2⤵
  PID:1504

C:\Program Files (x86)\Common Files\System\backup.exe
"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
1⤵
PID:2464
- C:\Program Files (x86)\Common Files\System\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\
  2⤵
  PID:1188
- C:\Program Files (x86)\Common Files\System\en-US\data.exe
  "C:\Program Files (x86)\Common Files\System\en-US\data.exe" C:\Program Files (x86)\Common Files\System\en-US\
  2⤵
  PID:2880
- C:\Program Files (x86)\Common Files\System\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\System\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\es-ES\
  2⤵
  PID:2544
- C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\System\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\fr-FR\
  2⤵
  PID:2200

C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe
"C:\Program Files (x86)\Google\Update\1.3.36.151\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.151\
1⤵
PID:1696

C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
1⤵
PID:1216

C:\Program Files\Windows Media Player\backup.exe
"C:\Program Files\Windows Media Player\backup.exe" C:\Program Files\Windows Media Player\
1⤵
PID:2848
- C:\Program Files\Windows Media Player\fr-FR\backup.exe
  "C:\Program Files\Windows Media Player\fr-FR\backup.exe" C:\Program Files\Windows Media Player\fr-FR\
  2⤵
  PID:928
- C:\Program Files\Windows Media Player\it-IT\backup.exe
  "C:\Program Files\Windows Media Player\it-IT\backup.exe" C:\Program Files\Windows Media Player\it-IT\
  2⤵
  PID:1912
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\update.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
    3⤵
    PID:784
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
    3⤵
    PID:2204
- C:\Program Files\Windows Media Player\ja-JP\backup.exe
  "C:\Program Files\Windows Media Player\ja-JP\backup.exe" C:\Program Files\Windows Media Player\ja-JP\
  2⤵
  PID:2116
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\
  2⤵
  PID:1956

C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\art\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\art\
1⤵
PID:444

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\
1⤵
PID:1564

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2720

C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
1⤵
PID:2016

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\
1⤵
PID:2008

C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
1⤵
PID:2820

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\
1⤵
PID:1744
- C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\
  2⤵
  PID:1740
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
    3⤵
    PID:1000
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\data.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
    3⤵
    PID:784
- - C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\System Restore.exe
    "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
    3⤵
    PID:2968
- C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
  2⤵
  PID:3000
- C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\
  2⤵
  PID:1504
- C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
  2⤵
  PID:2580
- C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\
  2⤵
  PID:2548

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\
1⤵
PID:1044
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
  2⤵
  PID:356
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
  2⤵
  PID:2856
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
  2⤵
  PID:2596
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
  2⤵
  PID:2340
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
  2⤵
  PID:2580
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
  2⤵
  PID:1764
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
  2⤵
  PID:1920

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
1⤵
PID:2976
- C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\
  2⤵
  PID:1888
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
    3⤵
    PID:1192
  - - C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\data.exe
      "C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
      4⤵
      PID:2044
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
    3⤵
    PID:1628
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
    3⤵
    PID:2720
  - - C:\Program Files\Google\Chrome\Application\backup.exe
      "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
      4⤵
      PID:1252

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
1⤵
PID:1884

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
1⤵
PID:2316

C:\Program Files\VideoLAN\VLC\lua\http\System Restore.exe
"C:\Program Files\VideoLAN\VLC\lua\http\System Restore.exe" C:\Program Files\VideoLAN\VLC\lua\http\
1⤵
PID:844
- C:\Program Files (x86)\Google\Update\Offline\backup.exe
  "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
  2⤵
  PID:444
- C:\Program Files (x86)\Google\Update\Install\backup.exe
  "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
  2⤵
  PID:288
- C:\Program Files\Java\jre7\backup.exe
  "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
  2⤵
  PID:1504

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\
1⤵
PID:2780

C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
1⤵
PID:1732
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
  2⤵
  PID:1792
- - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
    "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
    3⤵
    PID:2112
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
  2⤵
  PID:288
- - C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
    3⤵
    PID:2384
- C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\update.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
  2⤵
  PID:2656
- C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
  2⤵
  PID:1056
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
  2⤵
  PID:2920
- - C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
    3⤵
    PID:696
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
  2⤵
  PID:2632
- - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
    3⤵
    PID:1684
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
  2⤵
  PID:1536
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
  2⤵
  PID:2488
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
  2⤵
  PID:1564
- - C:\Program Files\Java\jre7\bin\server\backup.exe
    "C:\Program Files\Java\jre7\bin\server\backup.exe" C:\Program Files\Java\jre7\bin\server\
    3⤵
    PID:1216
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
      4⤵
      PID:1048
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
      4⤵
      PID:1524
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
      4⤵
      PID:2952
- - C:\Program Files\Java\jre7\bin\plugin2\backup.exe
    "C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
    3⤵
    PID:2440
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\
  2⤵
  PID:1452
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
    3⤵
    PID:2972
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
    3⤵
    PID:2196
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
      4⤵
      PID:2396
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
      4⤵
      PID:2924
  - - C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
      4⤵
      PID:2920
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\
    3⤵
    PID:2444
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
    3⤵
    PID:1164
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
    3⤵
    PID:444

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
1⤵
PID:2240

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
1⤵
PID:1056

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
1⤵
PID:2800

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
1⤵
PID:2716

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
1⤵
PID:2928

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
1⤵
PID:2696
- C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\
  2⤵
  PID:2260

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
1⤵
PID:2776
- C:\Program Files\Mozilla Firefox\uninstall\backup.exe
  "C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
  2⤵
  PID:3012
- C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
  2⤵
  PID:2220
- C:\Program Files\Mozilla Firefox\fonts\backup.exe
  "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
  2⤵
  PID:2000
- C:\Program Files\Mozilla Firefox\defaults\backup.exe
  "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
  2⤵
  PID:1172
- C:\Program Files\Mozilla Firefox\browser\backup.exe
  "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
  2⤵
  PID:2964

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\update.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
1⤵
PID:2016

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
1⤵
PID:2728

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\
1⤵
PID:2544

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:2448
- C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
  2⤵
  PID:2264

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\
1⤵
PID:1504

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
1⤵
PID:2500
- C:\Program Files\DVD Maker\Shared\backup.exe
  "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
  2⤵
  PID:1604
- C:\Program Files\DVD Maker\it-IT\data.exe
  "C:\Program Files\DVD Maker\it-IT\data.exe" C:\Program Files\DVD Maker\it-IT\
  2⤵
  PID:2220
- C:\Program Files\DVD Maker\fr-FR\backup.exe
  "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
  2⤵
  PID:2388
- C:\Program Files\DVD Maker\es-ES\backup.exe
  "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
  2⤵
  PID:856
- C:\Program Files\DVD Maker\en-US\backup.exe
  "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
  2⤵
  PID:880

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
1⤵
PID:1712
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
  2⤵
  PID:628
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
  2⤵
  PID:1664
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
  2⤵
  PID:1320
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
  2⤵
  PID:2056
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
  2⤵
  PID:2280

C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\
1⤵
PID:1428
- C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
  2⤵
  PID:572
- C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
  2⤵
  PID:1880
- C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\de-DE\backup.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
  2⤵
  PID:640

C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
1⤵
PID:2708

C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
1⤵
PID:1384

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
1⤵
PID:3056
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
  2⤵
  PID:1796
- - C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\
    3⤵
    PID:2008
- - C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
    3⤵
    PID:1280

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
1⤵
PID:960

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
1⤵
PID:824

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
1⤵
PID:1564

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\
1⤵
PID:692
- C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
  2⤵
  PID:592

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
1⤵
PID:640

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\
1⤵
PID:2836
- C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
  2⤵
  PID:1472

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
1⤵
PID:328

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\
1⤵
PID:2968

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
1⤵
PID:2992

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
1⤵
PID:2636

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\
1⤵
PID:356

C:\Program Files\Windows NT\backup.exe
"C:\Program Files\Windows NT\backup.exe" C:\Program Files\Windows NT\
1⤵
PID:408
- C:\Program Files\Windows NT\Accessories\backup.exe
  "C:\Program Files\Windows NT\Accessories\backup.exe" C:\Program Files\Windows NT\Accessories\
  2⤵
  PID:960

C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
1⤵
PID:600

C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
1⤵
PID:2108

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\System Restore.exe
"C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
1⤵
PID:1628

C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
1⤵
PID:1796
- C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\
  2⤵
  PID:1920
- C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\
  2⤵
  PID:1512

C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
1⤵
PID:2412

C:\Program Files (x86)\Common Files\Adobe AIR\update.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
1⤵
PID:1232

C:\Program Files (x86)\Common Files\Adobe\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
1⤵
PID:1252
- C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe
  "C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
  2⤵
  PID:1840

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
1⤵
PID:2536

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
1⤵
PID:696

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
1⤵
PID:1716
- C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
  2⤵
  PID:1744

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\update.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
1⤵
PID:2236

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:2584

C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
1⤵
PID:2952
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\
  2⤵
  PID:2344

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:2796
- C:\Program Files (x86)\Microsoft Office\backup.exe
  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
  2⤵
  PID:2652

C:\Program Files\Windows Photo Viewer\backup.exe
"C:\Program Files\Windows Photo Viewer\backup.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:2612

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:3008

C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
"C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
1⤵
PID:1500
- C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
  2⤵
  PID:1932

C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
1⤵
PID:1096

C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
"C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
1⤵
PID:536

C:\Program Files\Microsoft Games\backup.exe
"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
1⤵
PID:1764

C:\Program Files\Java\jre7\lib\security\backup.exe
"C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
1⤵
PID:2248

C:\Program Files\Java\jre7\lib\jfr\backup.exe
"C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
1⤵
PID:2908

C:\Program Files\Java\jre7\lib\images\backup.exe
"C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
1⤵
PID:796

C:\Program Files\Java\jre7\lib\fonts\backup.exe
"C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\
1⤵
PID:1876

C:\Program Files\Java\jre7\lib\ext\backup.exe
"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
1⤵
PID:1792

C:\Program Files\Java\jre7\lib\cmm\backup.exe
"C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
1⤵
PID:1452

C:\Program Files\Java\jre7\lib\amd64\backup.exe
"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
1⤵
PID:268
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
  2⤵
  PID:3028

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
1⤵
PID:3028

C:\Program Files\Windows Portable Devices\update.exe
"C:\Program Files\Windows Portable Devices\update.exe" C:\Program Files\Windows Portable Devices\
1⤵
PID:2212
- C:\Program Files\Common Files\System\backup.exe
  "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
  2⤵
  PID:2976
- C:\Program Files\Common Files\SpeechEngines\backup.exe
  "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
  2⤵
  PID:1500
- C:\Program Files\Common Files\Microsoft Shared\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
  2⤵
  PID:1116

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
1⤵
PID:2064

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
1⤵
PID:2956

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
1⤵
PID:2552
- C:\Program Files\VideoLAN\VLC\plugins\services_discovery\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\services_discovery\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\services_discovery\
  2⤵
  PID:2440
- C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe
  "C:\Program Files\VideoLAN\VLC\plugins\spu\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\spu\
  2⤵
  PID:876

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
1⤵
PID:1216

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
1⤵
PID:328

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
1⤵
PID:1940

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
1⤵
PID:2276

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:844

C:\Program Files\Internet Explorer\SIGNUP\backup.exe
"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
1⤵
PID:2716

C:\Program Files\Internet Explorer\ja-JP\backup.exe
"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
1⤵
PID:1164

C:\Program Files\Internet Explorer\it-IT\backup.exe
"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
1⤵
PID:1072

C:\Program Files\Internet Explorer\images\backup.exe
"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
1⤵
PID:2488

C:\Program Files\Internet Explorer\es-ES\backup.exe
"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
1⤵
PID:2020

C:\Program Files\Internet Explorer\en-US\backup.exe
"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
1⤵
PID:3012

C:\Program Files\Internet Explorer\backup.exe
"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
1⤵
PID:2040

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:2440

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:2500

C:\Program Files\Windows Sidebar\backup.exe
"C:\Program Files\Windows Sidebar\backup.exe" C:\Program Files\Windows Sidebar\
1⤵
PID:1696

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:2212

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
PID:3016

C:\Program Files\backup.exe
"C:\Program Files\backup.exe" C:\Program Files\
1⤵
PID:1264

C:\PerfLogs\backup.exe
C:\PerfLogs\backup.exe C:\PerfLogs\
1⤵
PID:2508

C:\data.exe
\data.exe \
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
10KB

MD5
e19782750d1aa0926926c6e033e7b29f

SHA1
71d0a38eb27b05211f89b81f397396b5ca33e3c1

SHA256
b9319ebff774e09bf1873cc7094c56ec9ef91befa398d6a6e44657884b1baec9

SHA512
46fb254f360ab58d73477dd9cf0b6968b80a077d0ab0c163242a3872f0faf4a086ff40e41bf2f21d0326cea8d241e72846dcbac6bd0bba25c76e678737dc0cf0

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
16KB

MD5
93e7c44097393b228084918a4d481740

SHA1
b4ae9db6d674dcb14c7be43ad09bae6d324ed2b9

SHA256
669a3414ebaf9371889d60a2cf8566114f298a6041c85fe0d70bb47370774a74

SHA512
6ccb392c938d6fa1b39221a0d15bccc594df5f7e1f74e019a81fd64b0bcbe5fa521972b6377c837fc4ca95c9977f6ea30341d73547bf94d30ac99e9842dd5b35

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
eb820dac59df5dc952f7590f31da5b84

SHA1
e21d24986d0eb0fac28f9be7ed382e4c5b1cf56d

SHA256
d8eef4ae704a42c3e17f54268f8a4252ebafda1341b21a28bf3a1adbf77011d2

SHA512
21280e2fe22aecd61663587ef6eb6fec1f2a74f22d295e061ebcc9471d1ecf878942ada009f55f057246698cd217e01d7a5d963d47ef6b833e55c97d1c8a8b88

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
ca15e7bfaddfcd712a859af933f1ff17

SHA1
14c8d3810e9c482ee8caab644a4b38be5c963d63

SHA256
50c6069115247131f2fecd40b5cd2e2a70268a4ff6d82c070be03b942c41c22e

SHA512
5f4e87a7aa660f5ce6edd5c99faf186ed5c684ccac81f48a77a10c7e49c289a880a46394bcedda2042d7096ab746293438a101696b41d5ac8e27d5a10c06fd00

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
ab63252ca52424143f5e3a85292cb065

SHA1
0407f8f21b16e5f529e0e1d375d03608a7285610

SHA256
f3c585bab5068642cb003814a5a4993bf1968cee5ad0459cd3ed2ff05b610890

SHA512
352e32034f782cda74abb952aa765a5708f9dbc8d6702be827f41028c54cb57ab68c4f085645a27beaf3d88b62f635d0779626900e0e76cd199676d571b45125

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
15KB

MD5
b0f98d2a03265990fd32c6618ca7234f

SHA1
de2fa095b456711dd7993b7a9c4b96b8177cc938

SHA256
a6943920369902f94568c4571218e64c4030dee74bec8afdb199fd8dafa89288

SHA512
02282b22af0930cb726c6466c2d889b09f940c6f650f0c55c99cba81eefcdace2bfe9a68f5134bae0b9ae6a11cf46b710188213306464ec030e9589565f1d542

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
14KB

MD5
7644310d01fae799f68e80a2c609de70

SHA1
3759f59d00815fa6d63d4a792b6ed63ff57b7807

SHA256
d878e5750ae098d82e085f1a159b4522124159ddff46540ff9da937e8d78d940

SHA512
4ce585725c43ea104315a1ff1cb6e016685fa65cfbd27c34d5d3996f66301ea106d23df82911d407e79761f012895266dada3d0af3b73559077f1ed6b4d64709

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe

Filesize
27KB

MD5
b12454144be3e2fc30ea17c192f063b9

SHA1
92e017552aa8def940106071267facbd04573ab2

SHA256
6b79113602cfcca531d87c292936c3cbea954d933d27c9a8a94dbd19e368ad29

SHA512
0c1aae5de633ea5c795e40a3be2e3eb494eb4906b002c0503289cccef9ff0809bdfb1ca42c695e1a7f544e64050780d1d2b360a62c2d70f4dbcf99fbc5b87a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
5KB

MD5
6a61e0e96b50595b410ca5864f660d54

SHA1
52e26f057530e8e18c302ad4957bb7f8acb3cd5e

SHA256
62b606f4af2466a29b93cefe174e305b15584b1aece0ef819fa1e55d800071e0

SHA512
1a263b2e8ab27e1347f27e74378ec2c46cf20c90de41ea9cec0534ea1d4d770cc1eb81bc7343257c9bb457e9ff131adc9df0d3f5bb28fd888e233ff84d252a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\CRX_INSTALL\backup.exe

Filesize
72KB

MD5
46fe55585b442a6be5825cf8df6a9adf

SHA1
d4e501e486782f7a933e131549694a571389d18a

SHA256
5a878d8921248653ceef7323baeef65b7f536eb3c3223085677ca5409e3a78e3

SHA512
ec79a83675592003070d56c15f374112ec39e41c366044fc1527793219067b5d9d2ba390a2ebabd135569566ec8714be0dfaedf5bff4d63ad4b449d7d8aef25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_1603549830\backup.exe

Filesize
50KB

MD5
5eea904999a23cd5c8cb945f4ed7d2c9

SHA1
d085fae83a9d2959a74702979a1982918bc380b8

SHA256
a0462370126fd89d27a592b7f1d6fa98ade9438b0fd1d5fbc4eff8730cd6f4f9

SHA512
3c21464037faf746c1b4ab9bdcdaca847c42411a71fbda18fce9d081dcf1fa36f226cc819bc3b635fd051b80465a8501ebcfe4eb721c264ded677cb6de9d23be

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
61KB

MD5
22348fc0c0ebacc70456abbd3cf19196

SHA1
7da27f13b6d3c48bb2e10caa15165415a159ce5a

SHA256
92877dd7702999853900e1de8b51d5223bd0be254e7613e03f5cac71166c2ea9

SHA512
c24b54695806bf564117cd9bc2ddc5b4072b522745742182f6d91864db5280f48c7bbd2668c0bf47bb9f2b0791c8c8749317b2791bd5adb6c43e18ea87d8a6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
72KB

MD5
4ce3eb7c9eeb6bc3d61e5460cb9094c7

SHA1
9b6f7a5b2e56890670a497493b4d894ec43700b7

SHA256
1f54d6dd5c65a68693d0563c16a2bf61d0828ba18f167a00b6900b514320287d

SHA512
a2bd5fd07c7b90c2ada775d076261ac1a7309ff78dfef8355b56232c51433e7a95c44d3ad6192bb0e2aeaca784bf37fcfe58537fbfed00c8672da5f7ca4c0509

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
5KB

MD5
afcb48bd789e7b832e96abd776a93e6f

SHA1
1041e2cc1f3c4b64a929d88f6c3b0e55463f7d14

SHA256
4c0d102019e183af45ef00d3feac9d7dc0167ddebde98a48b7d5299a8c9c69b5

SHA512
a298a7b45dfe6bbf908411ff45ba02434ea241a7f95699fc148287dc6790ea0ad55237f71ee08494e53fd8f28e16cd746dff1e7f751641c8fbb43f7dac8161c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
15KB

MD5
8859185b37a7b57e1628845f00f89e00

SHA1
0c47c1cf70bff1caa2bd04a8c7b3bf3da6bcd262

SHA256
6e683ab594e7528370183c05b6890055be007ed137c7361ad8becca3ad2a5231

SHA512
0ed2663f838519a2f0c9b299c33e1a541ce0cbe0f868beeb49919d05d083a871fc3b5d280abce5c456bd8d2864f598d6cc0e14f756b3ae6e0f25b65f9fc2aeca

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\data.exe

Filesize
72KB

MD5
650c0c6844720c2b54039143f6fd43df

SHA1
5659505a3be4bf998b00f1a729889ffa585728cf

SHA256
bc2b3ad32fb857ce04e0741a4501214c8c1804b86c19b4a7c2a58696cbbf1ccd

SHA512
b4e14a6a75eea7c6cf1dfc4b4f0617eeef14ee9f75d1fb429bd6dd18d8a28f89e873e038609a1ddf4f989a6e1a842cc90775a4e66c2b9e835c8ff82f4258c2f2

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
25KB

MD5
1d619955bf7ad03f057b12110f8afcc4

SHA1
b4675689a85099c5a850f4314dbfa35ce409ead3

SHA256
30d2fc2518c2e9d8222e8981ef6ecd76b1e6441d606c63e32eb6e932731f6f05

SHA512
79f3587c986019bce624a2a4726d3d6f01ecc97184500a0694bdf0c74c5326b5e6d5e23ab189fe43a909670aaa8a341a229cee2f392c6332155ba32345120cf5

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
45KB

MD5
925e7290fc849bd8686d1c84fbf181d7

SHA1
9ce5faaf1ccb1fea26809d66a06c1b6c1c300583

SHA256
cb3627a9a86153ad279169c7639fcabe486d1c19c99bf777f0b2fe379d972f80

SHA512
c91f8afaaf5a2669e6a6be4d9f7497b5865528d33856d23de309a59acc8124e5fc5027dd4dcc6e377d4b033d5c5d7d185bc09cb5d7b5976e6d6d090350357e23

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe

Filesize
31KB

MD5
e5a807443ec6d304c802c23aa441ed11

SHA1
10b07b5b09b1677d07081c8bec65bdb95de841be

SHA256
ed7cd5b2f2a1ff72550da7cc6ce25baf8fb82e3872ecf88ee22a3354b0a808d7

SHA512
c8b54b1652866dfde6fed117fb303ab6a2ad117eaf6ab95a84d75c372201258964e399db15b947fb9ea093e748ddfc804f992b208ca0fba6787fd89d94f31fad

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe

Filesize
60KB

MD5
88f702ecd7e2cef8db201303200980c3

SHA1
92ea1a97bdd1705cc2a88df01a5252321d7a255f

SHA256
c09ce5dafb58cf5d140c43f4ddf4804b4a4bcaa27cfba047fbc73d67a80dcdce

SHA512
851878822dd73ab0dfc44242e4a7dbfaac2aa70fcd08e279c46dc0f7a6feff3f956a5cbf8d82b3870bb3b38e92d6b23af3a96cc74062252f815aa30abba75781

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
19KB

MD5
0c56abca8e6e4eb6a4d7fe7f022a05d6

SHA1
4eda4008c62b52286534e31269fa28dd91d49413

SHA256
34070882b63e2f7ad6c9c3277cb3ec20193cd205090a5cf3b8174d12510c489b

SHA512
911c5ea464fd213bdb5b2225f67d05802b0a20486c018224a4e84aed3b7dc4cc5539997583722d542f79a8fc02d0d2b6b13b325b41e88711572f3cdfddf5f921

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\CRX_INSTALL\backup.exe

Filesize
6KB

MD5
2d6d14893a8e6023ea0242710298c516

SHA1
adfb09b781fbc7f01a218fbf9bc80bd97141f34e

SHA256
88c518ffc1f16d1a85590ddcd3ef799f29f67414a772d3c8b2b2dad985bba4c5

SHA512
1f9e16d38b4c66cc22f9f781b6fc023efd7e9035d93b2989295de5528d7b387f06d719548337dd6e6697d6568269cc5bc4ea542cd4355dc4052a7b983af57691

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
44KB

MD5
ccaaabd694668e1a6a764a0f90ccc877

SHA1
2ac85cd3b31fc77f38d4c26bec158f18be8df68b

SHA256
6d49bc7f5ab82e4db09e630fc55bca43f1f63cf40196bff3bcaa98d99df99bca

SHA512
8067f17e008c0b2820465e35a1b9d28d06877e8bbf2f4febd8fd4665564e744f5a94ca639a6f1e1759905c782680275c0e8d18c3a6e98fec7bde36c62dc37cd4

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2104_706045420\backup.exe

Filesize
32KB

MD5
5a6ac6b581004b19b08d6d6038a8216a

SHA1
3806e0a33a738f546c0396a171a38cbdea9faccd

SHA256
8c45ef7df02ff9c84a6d9049d5fbf5def584b6043e36ae12d8e94bb7a6182316

SHA512
17ad615ae0bb5eab6737252d654fc3d268ce43ed34f7b0fa9322b1a95b2a47f999f914353c587574df21a61863fec82700f9100f37708d780db2ee691ed72a50

Download Submit
memory/2336-119-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads