595af5f5926281fe41bb5a536c1d08e44d5fc387c59372bb6807dd12a91f65e0

Analysis

max time kernel
0s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3890531ec3647f7cf92db12648795871.exe
Size

72KB
MD5

3890531ec3647f7cf92db12648795871
SHA1

9565cfe5eddf6fc5b2d3d348f91332c134bb2444
SHA256

595af5f5926281fe41bb5a536c1d08e44d5fc387c59372bb6807dd12a91f65e0
SHA512

6802e69e14e3288713d0776d34e0234730b0669cbeda0add8a63450b849774327a2bae40979cec47bc50e5ddca545d0ef0073e4d6a9852e38c13c8aeec77985e
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2Z:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrV

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	3890531ec3647f7cf92db12648795871.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3890531ec3647f7cf92db12648795871.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3890531ec3647f7cf92db12648795871.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 3 IoCs

pid	Process
2504	backup.exe
2336	data.exe
2724	backup.exe

Loads dropped DLL 7 IoCs

pid	Process
2928	3890531ec3647f7cf92db12648795871.exe
2928	3890531ec3647f7cf92db12648795871.exe
2928	3890531ec3647f7cf92db12648795871.exe
2928	3890531ec3647f7cf92db12648795871.exe
2928	3890531ec3647f7cf92db12648795871.exe
2928	3890531ec3647f7cf92db12648795871.exe
2928	3890531ec3647f7cf92db12648795871.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2928	3890531ec3647f7cf92db12648795871.exe
2504	backup.exe
2336	backup.exe
2724	backup.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2504	2928	3890531ec3647f7cf92db12648795871.exe	943
PID 2928 wrote to memory of 2504	2928	3890531ec3647f7cf92db12648795871.exe	943
PID 2928 wrote to memory of 2504	2928	3890531ec3647f7cf92db12648795871.exe	943
PID 2928 wrote to memory of 2504	2928	3890531ec3647f7cf92db12648795871.exe	943
PID 2928 wrote to memory of 2336	2928	3890531ec3647f7cf92db12648795871.exe	942
PID 2928 wrote to memory of 2336	2928	3890531ec3647f7cf92db12648795871.exe	942
PID 2928 wrote to memory of 2336	2928	3890531ec3647f7cf92db12648795871.exe	942
PID 2928 wrote to memory of 2336	2928	3890531ec3647f7cf92db12648795871.exe	942
PID 2928 wrote to memory of 2724	2928	3890531ec3647f7cf92db12648795871.exe	941
PID 2928 wrote to memory of 2724	2928	3890531ec3647f7cf92db12648795871.exe	941
PID 2928 wrote to memory of 2724	2928	3890531ec3647f7cf92db12648795871.exe	941
PID 2928 wrote to memory of 2724	2928	3890531ec3647f7cf92db12648795871.exe	941

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	3890531ec3647f7cf92db12648795871.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	3890531ec3647f7cf92db12648795871.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	3890531ec3647f7cf92db12648795871.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3890531ec3647f7cf92db12648795871.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe

C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
1⤵
PID:1232
- C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\
  2⤵
  PID:812

C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\
1⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\backup.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\
1⤵
PID:2708

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
1⤵
PID:1828

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:1996

C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
1⤵
PID:1060

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:1696

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
1⤵
PID:1716

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
1⤵
PID:2336

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
1⤵
PID:1140
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\
  2⤵
  PID:2640

C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
1⤵
PID:1300

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
1⤵
PID:2980

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:2652
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\
  2⤵
  PID:2876
- - C:\Program Files\Google\Chrome\Application\backup.exe
    "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
    3⤵
    PID:2904

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
1⤵
PID:1240

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
1⤵
PID:628
- C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
  2⤵
  PID:2120
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\
    3⤵
    PID:672
- C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\es-ES\backup.exe" C:\Program Files\Microsoft Games\Purble Place\es-ES\
  2⤵
  PID:2676
- C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Purble Place\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Purble Place\ja-JP\
  2⤵
  PID:1668

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
1⤵
PID:1832
- C:\Program Files\Common Files\System\ado\de-DE\backup.exe
  "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
  2⤵
  PID:1524
- C:\Program Files\Common Files\System\ado\es-ES\backup.exe
  "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
  2⤵
  PID:1380
- C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
  "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
  2⤵
  PID:2052
- C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
  "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
  2⤵
  PID:2152
- C:\Program Files\Common Files\System\ado\it-IT\data.exe
  "C:\Program Files\Common Files\System\ado\it-IT\data.exe" C:\Program Files\Common Files\System\ado\it-IT\
  2⤵
  PID:3048
- C:\Program Files\Common Files\System\ado\en-US\backup.exe
  "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
  2⤵
  PID:2256

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
1⤵
PID:960

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
1⤵
PID:1756

C:\Program Files\Common Files\Microsoft Shared\MSInfo\update.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:908
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  PID:1252
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
  2⤵
  PID:328

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
1⤵
PID:2524
- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
  2⤵
  PID:2240

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:2712
- C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
  2⤵
  PID:864

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:2620
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:2140
- C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
  2⤵
  PID:2132
- - C:\Program Files\Internet Explorer\fr-FR\backup.exe
    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
    3⤵
    PID:1532
  - - C:\Program Files\Reference Assemblies\Microsoft\backup.exe
      "C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\
      4⤵
      PID:1684
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\
        5⤵
        
        PID:1972
- - C:\Program Files\Internet Explorer\images\backup.exe
    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
    3⤵
    PID:1708
- - C:\Program Files\Internet Explorer\it-IT\data.exe
    "C:\Program Files\Internet Explorer\it-IT\data.exe" C:\Program Files\Internet Explorer\it-IT\
    3⤵
    PID:2028
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\data.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:384

C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:1668
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\
  2⤵
  PID:2512

C:\Program Files\Common Files\Services\backup.exe
"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
1⤵
PID:2276

C:\Program Files\Common Files\SpeechEngines\backup.exe
"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
1⤵
PID:1580

C:\Program Files\Common Files\System\backup.exe
"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
1⤵
PID:352
- C:\Program Files\Common Files\System\it-IT\backup.exe
  "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
  2⤵
  PID:2676
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\
    3⤵
    PID:1792
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\
    3⤵
    PID:2868
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\
    3⤵
    PID:2956
- C:\Program Files\Common Files\System\msadc\backup.exe
  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
  2⤵
  PID:1748
- - C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
    3⤵
    PID:2864

C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
1⤵
PID:2520

C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
1⤵
PID:2280

C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
1⤵
PID:2068

C:\Program Files\DVD Maker\es-ES\backup.exe
"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
1⤵
PID:2172

C:\Program Files\DVD Maker\it-IT\backup.exe
"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
1⤵
PID:1184
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\
  2⤵
  PID:1436

C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe
"C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
1⤵
PID:2020
- C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
  2⤵
  PID:3016
- C:\Program Files\DVD Maker\Shared\DvdStyles\Full\data.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
  2⤵
  PID:912
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\
    3⤵
    PID:1528
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\
      4⤵
      PID:1276
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\
        5⤵
        
        PID:1028
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\
    3⤵
    PID:1620
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
      4⤵
      PID:920
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\update.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
      4⤵
      PID:576
    - - C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\data.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\
        5⤵
        
        PID:2092
      - C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\data.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\
        6⤵
        
        PID:1356
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\
        7⤵
        
        PID:2092
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\
        7⤵
        
        PID:1132
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\
        7⤵
        
        PID:2800
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\
        7⤵
        
        PID:2896
        
        C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\update.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\update.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\
        7⤵
        
        PID:2028
        
        C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Hearts\ja-JP\
        7⤵
        
        PID:1664
        
        C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\it-IT\backup.exe" C:\Program Files\Microsoft Games\Hearts\it-IT\
        7⤵
        
        PID:1588
        
        C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe
        
        "C:\Program Files\Microsoft Games\Hearts\en-US\backup.exe" C:\Program Files\Microsoft Games\Hearts\en-US\
        7⤵
        
        PID:320
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\
      4⤵
      PID:2556
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\
        5⤵
        
        PID:2564
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\
        5⤵
        
        PID:2884
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\
        6⤵
        
        PID:2624
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\
        6⤵
        
        PID:2612
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\
        6⤵
        
        PID:2648
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\
        6⤵
        
        PID:2940
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\
        6⤵
        
        PID:540
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\
        6⤵
        
        PID:1436
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\
        6⤵
        
        PID:1620
        
        C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\
        7⤵
        
        PID:888
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\
        6⤵
        
        PID:1980
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\
        6⤵
        
        PID:1708
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\
        6⤵
        
        PID:1060
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\
        6⤵
        
        PID:1000
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\
        6⤵
        
        PID:1692
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\
        6⤵
        
        PID:3032
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\
        6⤵
        
        PID:1672
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\
        6⤵
        
        PID:1216
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\update.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\
        6⤵
        
        PID:2552
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
        7⤵
        
        PID:1724
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
        7⤵
        
        PID:328
      - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\
        6⤵
        
        PID:2708
    - - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\
        5⤵
        
        PID:636
      - C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\
        6⤵
        
        PID:996
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\
      4⤵
      PID:1612
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\
      4⤵
      PID:2924
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\data.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\
        5⤵
        
        PID:1796
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\
        5⤵
        
        PID:2640
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\
      4⤵
      PID:2772
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\
      4⤵
      PID:2620
- C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
  2⤵
  PID:1244
- C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
  2⤵
  PID:2560
- C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
  2⤵
  PID:1044
- C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
  2⤵
  PID:1868
- C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
  2⤵
  PID:2212
- C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
  2⤵
  PID:2204
- C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
  2⤵
  PID:1660
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\
  2⤵
  PID:2780

C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
1⤵
PID:2764
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
  2⤵
  PID:2148
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\
    3⤵
    PID:2644

C:\Program Files\Java\jdk1.7.0_80\data.exe
"C:\Program Files\Java\jdk1.7.0_80\data.exe" C:\Program Files\Java\jdk1.7.0_80\
1⤵
PID:2920
- C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
  2⤵
  PID:1344
- C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
  2⤵
  PID:1372
- C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\
  2⤵
  PID:2132
- - C:\Program Files\Internet Explorer\SIGNUP\backup.exe
    "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
    3⤵
    PID:888
- - C:\Program Files\Internet Explorer\ja-JP\backup.exe
    "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
    3⤵
    PID:3020
- - C:\Program Files\Internet Explorer\es-ES\backup.exe
    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
    3⤵
    PID:1500
- - C:\Program Files\Internet Explorer\en-US\backup.exe
    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
    3⤵
    PID:1628
- - C:\Program Files\Internet Explorer\de-DE\backup.exe
    "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
    3⤵
    PID:3060
- C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
  2⤵
  PID:2116
- C:\Program Files\Java\jdk1.7.0_80\db\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\
  2⤵
  PID:2288

C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\db\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
1⤵
PID:1988

C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\System Restore.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\
1⤵
PID:532

C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\
1⤵
PID:2180

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\
1⤵
PID:2716

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\
1⤵
PID:2140

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\data.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\
1⤵
PID:964

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\
1⤵
PID:2024
- C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
  2⤵
  PID:2676
- - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
    3⤵
    PID:1872
  - - C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Mahjong\ja-JP\
      4⤵
      PID:2248
  - - C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\it-IT\backup.exe" C:\Program Files\Microsoft Games\Mahjong\it-IT\
      4⤵
      PID:960
  - - C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Mahjong\fr-FR\
      4⤵
      PID:2848
  - - C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Mahjong\de-DE\backup.exe" C:\Program Files\Microsoft Games\Mahjong\de-DE\
      4⤵
      PID:2496
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\
    3⤵
    PID:2800
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\
    3⤵
    PID:2672
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\
    3⤵
    PID:2628
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\
    3⤵
    PID:2924
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\System Restore.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\
    3⤵
    PID:2720
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\
    3⤵
    PID:1812
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\
    3⤵
    PID:2240
- - C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\
    3⤵
    PID:1716
- C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\
  2⤵
  PID:2684
- - C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
    3⤵
    PID:2984
- - C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
    3⤵
    PID:2816
- - C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
    3⤵
    PID:1232

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\
1⤵
PID:2792

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\
1⤵
PID:864

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\
1⤵
PID:1976

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\
1⤵
PID:1524

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\
1⤵
PID:688
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\System Restore.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\
  2⤵
  PID:1380

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\
1⤵
PID:2160
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\
  2⤵
  PID:1716
- C:\Program Files\Microsoft Games\Chess\backup.exe
  "C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
  2⤵
  PID:2872
- - C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\
    3⤵
    PID:2636
- - C:\Program Files\Microsoft Games\Chess\it-IT\update.exe
    "C:\Program Files\Microsoft Games\Chess\it-IT\update.exe" C:\Program Files\Microsoft Games\Chess\it-IT\
    3⤵
    PID:2708
- - C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\Chess\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Chess\ja-JP\
    3⤵
    PID:2812
- C:\Program Files\Microsoft Games\FreeCell\backup.exe
  "C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
  2⤵
  PID:1796
- - C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\
    3⤵
    PID:1728
- - C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\ja-JP\backup.exe" C:\Program Files\Microsoft Games\FreeCell\ja-JP\
    3⤵
    PID:2944
  - - C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\
      4⤵
      PID:860
- - C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\it-IT\backup.exe" C:\Program Files\Microsoft Games\FreeCell\it-IT\
    3⤵
    PID:1096
- - C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\
    3⤵
    PID:332
- - C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe
    "C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\
    3⤵
    PID:2596
- - C:\Program Files\Microsoft Games\FreeCell\de-DE\update.exe
    "C:\Program Files\Microsoft Games\FreeCell\de-DE\update.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\
    3⤵
    PID:2132
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\
      4⤵
      PID:1892
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\
      4⤵
      PID:912
- C:\Program Files\Microsoft Games\Mahjong\backup.exe
  "C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\
  2⤵
  PID:1872
- - C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Mahjong\en-US\backup.exe" C:\Program Files\Microsoft Games\Mahjong\en-US\
    3⤵
    PID:1976
- - C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Mahjong\es-ES\backup.exe" C:\Program Files\Microsoft Games\Mahjong\es-ES\
    3⤵
    PID:2676
- C:\Program Files\Microsoft Games\Minesweeper\backup.exe
  "C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\
  2⤵
  PID:1948
- - C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\en-US\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\en-US\
    3⤵
    PID:1276
- - C:\Program Files\Microsoft Games\Minesweeper\ja-JP\System Restore.exe
    "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\System Restore.exe" C:\Program Files\Microsoft Games\Minesweeper\ja-JP\
    3⤵
    PID:2304
- - C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\it-IT\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\it-IT\
    3⤵
    PID:920
- - C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\fr-FR\
    3⤵
    PID:1380
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\
      4⤵
      PID:636
- - C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\es-ES\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\es-ES\
    3⤵
    PID:788
- - C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\Minesweeper\de-DE\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\de-DE\
    3⤵
    PID:2260
- C:\Program Files\Microsoft Games\Multiplayer\backup.exe
  "C:\Program Files\Microsoft Games\Multiplayer\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\
  2⤵
  PID:2336
- - C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Checkers\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\
    3⤵
    PID:1892
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\
      4⤵
      PID:1616
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        5⤵
        
        PID:2772
      - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\
        6⤵
        
        PID:2136
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        5⤵
        
        PID:1640
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        5⤵
        
        PID:672
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\update.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
        5⤵
        
        PID:2816
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
        6⤵
        
        PID:352
      - C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe
        
        "C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\
        6⤵
        
        PID:1432
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
        5⤵
        
        PID:2600
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\
      4⤵
      PID:840
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\
      4⤵
      PID:2944
    - - C:\Program Files\Java\jre7\bin\plugin2\backup.exe
        
        "C:\Program Files\Java\jre7\bin\plugin2\backup.exe" C:\Program Files\Java\jre7\bin\plugin2\
        5⤵
        
        PID:2980
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\
      4⤵
      PID:2088
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\
      4⤵
      PID:1284
  - - C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\
      4⤵
      PID:864
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\System Restore.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\
      4⤵
      PID:2784
- - C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe
    "C:\Program Files\Microsoft Games\Multiplayer\Spades\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\
    3⤵
    PID:2836
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\
      4⤵
      PID:2904
    - - C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
        5⤵
        
        PID:1432
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\
      4⤵
      PID:1708
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\
      4⤵
      PID:2620
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\System Restore.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\
        5⤵
        
        PID:2952
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\
      4⤵
      PID:2832
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\
      4⤵
      PID:2912
    - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\
        5⤵
        
        PID:2696
  - - C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\
      4⤵
      PID:1636

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\
1⤵
PID:844
- C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\
  2⤵
  PID:2664

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\
1⤵
PID:1888

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\
1⤵
PID:1152

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\
1⤵
PID:2712
- C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\
  2⤵
  PID:1600
- - C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jre7\lib\zi\SystemV\
    3⤵
    PID:1660
- - C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jre7\lib\zi\Pacific\
    3⤵
    PID:1768
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\
      4⤵
      PID:1264
- - C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Europe\backup.exe" C:\Program Files\Java\jre7\lib\zi\Europe\
    3⤵
    PID:3052
- - C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Australia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Australia\
    3⤵
    PID:2364
- - C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe
    "C:\Program Files\Java\jre7\lib\zi\Asia\backup.exe" C:\Program Files\Java\jre7\lib\zi\Asia\
    3⤵
    PID:2428

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\
1⤵
PID:384

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\
1⤵
PID:2172

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\
1⤵
PID:940

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\
1⤵
PID:960

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\
1⤵
PID:1680

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\
1⤵
PID:952

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\
1⤵
PID:2204

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\
1⤵
PID:1608

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\
1⤵
PID:2104
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\
  2⤵
  PID:1744
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\
    3⤵
    PID:3008

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\
1⤵
PID:2808

C:\Program Files\Java\jre7\backup.exe
"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
1⤵
PID:2672
- C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\
  2⤵
  PID:2188
- - C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe
    "C:\Program Files\Microsoft Games\More Games\ja-JP\backup.exe" C:\Program Files\Microsoft Games\More Games\ja-JP\
    3⤵
    PID:1040
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\
      4⤵
      PID:2800
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\
        5⤵
        
        PID:2276
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\
        5⤵
        
        PID:1968
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\update.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\update.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\
        5⤵
        
        PID:628
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\
        5⤵
        
        PID:2512
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\
        5⤵
        
        PID:860
      - C:\Windows\addins\backup.exe
        
        C:\Windows\addins\backup.exe C:\Windows\addins\
        6⤵
        
        PID:2172
      - C:\Windows\AppCompat\backup.exe
        
        C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
        6⤵
        
        PID:1528
      - C:\Windows\AppPatch\backup.exe
        
        C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
        6⤵
        
        PID:1660
      - C:\Windows\assembly\backup.exe
        
        C:\Windows\assembly\backup.exe C:\Windows\assembly\
        6⤵
        
        PID:1636
      - C:\Windows\Branding\backup.exe
        
        C:\Windows\Branding\backup.exe C:\Windows\Branding\
        6⤵
        
        PID:1240
      - C:\Windows\CSC\backup.exe
        
        C:\Windows\CSC\backup.exe C:\Windows\CSC\
        6⤵
        
        PID:2212
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\
        5⤵
        
        PID:2952
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\
        5⤵
        
        PID:2620
      - C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
        6⤵
        
        PID:1576
      - C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
        6⤵
        
        PID:2652
      - C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
        6⤵
        
        PID:2980
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\
        5⤵
        
        PID:2696
    - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\
        5⤵
        
        PID:2880
- - C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\More Games\it-IT\backup.exe" C:\Program Files\Microsoft Games\More Games\it-IT\
    3⤵
    PID:2272
- - C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\More Games\es-ES\backup.exe" C:\Program Files\Microsoft Games\More Games\es-ES\
    3⤵
    PID:1720
  - - C:\Program Files (x86)\Common Files\microsoft shared\VBA\data.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VBA\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\VBA\
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VC\
      4⤵
      PID:760
  - - C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VGX\
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Common Files\microsoft shared\VSTA\update.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTA\
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\VSTO\
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\
      4⤵
      PID:1732
- - C:\Program Files\Microsoft Games\More Games\en-US\backup.exe
    "C:\Program Files\Microsoft Games\More Games\en-US\backup.exe" C:\Program Files\Microsoft Games\More Games\en-US\
    3⤵
    PID:2204
- C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\
  2⤵
  PID:2020
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\
    3⤵
    PID:2868
  - - C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
      "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
      4⤵
      PID:964
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\
    3⤵
    PID:2888
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\
    3⤵
    PID:1812

C:\Program Files\Java\jre7\bin\dtplugin\backup.exe
"C:\Program Files\Java\jre7\bin\dtplugin\backup.exe" C:\Program Files\Java\jre7\bin\dtplugin\
1⤵
PID:2976
- C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
  "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
  2⤵
  PID:2972

C:\Program Files\Java\jre7\bin\server\data.exe
"C:\Program Files\Java\jre7\bin\server\data.exe" C:\Program Files\Java\jre7\bin\server\
1⤵
PID:2140

C:\Program Files\Java\jre7\lib\amd64\backup.exe
"C:\Program Files\Java\jre7\lib\amd64\backup.exe" C:\Program Files\Java\jre7\lib\amd64\
1⤵
PID:2208

C:\Program Files\Java\jre7\lib\cmm\backup.exe
"C:\Program Files\Java\jre7\lib\cmm\backup.exe" C:\Program Files\Java\jre7\lib\cmm\
1⤵
PID:2012

C:\Program Files\Java\jre7\lib\ext\backup.exe
"C:\Program Files\Java\jre7\lib\ext\backup.exe" C:\Program Files\Java\jre7\lib\ext\
1⤵
PID:1500

C:\Program Files\Java\jre7\lib\images\cursors\backup.exe
"C:\Program Files\Java\jre7\lib\images\cursors\backup.exe" C:\Program Files\Java\jre7\lib\images\cursors\
1⤵
PID:2320

C:\Program Files\Java\jre7\lib\management\backup.exe
"C:\Program Files\Java\jre7\lib\management\backup.exe" C:\Program Files\Java\jre7\lib\management\
1⤵
PID:1968

C:\Program Files\Java\jre7\lib\security\backup.exe
"C:\Program Files\Java\jre7\lib\security\backup.exe" C:\Program Files\Java\jre7\lib\security\
1⤵
PID:2276
- C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\
  2⤵
  PID:1000

C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Africa\backup.exe" C:\Program Files\Java\jre7\lib\zi\Africa\
1⤵
PID:1580

C:\Program Files\Java\jre7\lib\zi\America\backup.exe
"C:\Program Files\Java\jre7\lib\zi\America\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\
1⤵
PID:1344
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
  2⤵
  PID:1028
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
    3⤵
    PID:2212
- C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\
  2⤵
  PID:1712

C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Antarctica\backup.exe" C:\Program Files\Java\jre7\lib\zi\Antarctica\
1⤵
PID:832

C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Atlantic\backup.exe" C:\Program Files\Java\jre7\lib\zi\Atlantic\
1⤵
PID:1868

C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Etc\backup.exe" C:\Program Files\Java\jre7\lib\zi\Etc\
1⤵
PID:1696

C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe
"C:\Program Files\Java\jre7\lib\zi\Indian\backup.exe" C:\Program Files\Java\jre7\lib\zi\Indian\
1⤵
PID:3056

C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Hearts\de-DE\backup.exe" C:\Program Files\Microsoft Games\Hearts\de-DE\
1⤵
PID:2784
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
  2⤵
  PID:320
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
    3⤵
    PID:1184
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
    3⤵
    PID:2896
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
    3⤵
    PID:2464
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
    3⤵
    PID:1572
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
      4⤵
      PID:1600
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
        5⤵
        
        PID:2360
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
        5⤵
        
        PID:2552
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
        6⤵
        
        PID:1548
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\
  2⤵
  PID:1772

C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe
"C:\Program Files\Microsoft Games\Hearts\es-ES\backup.exe" C:\Program Files\Microsoft Games\Hearts\es-ES\
1⤵
PID:2696

C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\Hearts\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Hearts\fr-FR\
1⤵
PID:1240

C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe
"C:\Program Files\Microsoft Games\More Games\de-DE\backup.exe" C:\Program Files\Microsoft Games\More Games\de-DE\
1⤵
PID:952
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\
  2⤵
  PID:2368
- C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\
  2⤵
  PID:1528
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
    3⤵
    PID:2092

C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\More Games\fr-FR\backup.exe" C:\Program Files\Microsoft Games\More Games\fr-FR\
1⤵
PID:1608

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\
1⤵
PID:2124

C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe
"C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\
1⤵
PID:2864

C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\
1⤵
PID:2204

C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\
1⤵
PID:2332
- C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\
  2⤵
  PID:2632

C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\update.exe
"C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\update.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\
1⤵
PID:2500
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
  2⤵
  PID:2460

C:\Program Files\Microsoft Office\Office14\backup.exe
"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\
1⤵
PID:2192
- C:\Program Files\Microsoft Office\Office14\1033\backup.exe
  "C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\
  2⤵
  PID:3000

C:\Program Files\Mozilla Firefox\browser\backup.exe
"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
1⤵
PID:2808

C:\Program Files\Mozilla Firefox\defaults\backup.exe
"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
1⤵
PID:2236

C:\Program Files\Mozilla Firefox\fonts\backup.exe
"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
1⤵
PID:2144
- C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\
  2⤵
  PID:1096

C:\Program Files\MSBuild\update.exe
"C:\Program Files\MSBuild\update.exe" C:\Program Files\MSBuild\
1⤵
PID:2932

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
1⤵
PID:1356
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System Restore.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\
  2⤵
  PID:2840

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
1⤵
PID:2256
- C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe
  "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\
  2⤵
  PID:2176

C:\Program Files\VideoLAN\VLC\locale\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\backup.exe" C:\Program Files\VideoLAN\VLC\locale\
1⤵
PID:2352
- C:\Program Files\VideoLAN\VLC\locale\am\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\am\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\
  2⤵
  PID:2160
- - C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\
    3⤵
    PID:2612
- C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\as_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\
  2⤵
  PID:2980
- - C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\
    3⤵
    PID:2764
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
      4⤵
      PID:2976
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
      4⤵
      PID:2944
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
      4⤵
      PID:1952
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
      4⤵
      PID:2648
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\data.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\data.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
      4⤵
      PID:2624
- C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ast\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\
  2⤵
  PID:3060
- - C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\
    3⤵
    PID:2940
  - - C:\Program Files\7-Zip\Lang\backup.exe
      "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
      4⤵
      PID:2100
- C:\Program Files\VideoLAN\VLC\locale\az\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\az\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\
  2⤵
  PID:1692
- - C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\
    3⤵
    PID:3028
- C:\Program Files\VideoLAN\VLC\locale\bn\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\bn\
  2⤵
  PID:636
- C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\
  2⤵
  PID:2060
- - C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\
    3⤵
    PID:832
- C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\en_GB\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\
  2⤵
  PID:2628
- - C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\
    3⤵
    PID:1748
- C:\Program Files\VideoLAN\VLC\locale\eu\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\eu\update.exe" C:\Program Files\VideoLAN\VLC\locale\eu\
  2⤵
  PID:2696
- - C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\
    3⤵
    PID:2100
- C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\
  2⤵
  PID:2392
- - C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\
    3⤵
    PID:1976
- C:\Program Files\VideoLAN\VLC\locale\fi\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\fi\data.exe" C:\Program Files\VideoLAN\VLC\locale\fi\
  2⤵
  PID:2092
- C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\
  2⤵
  PID:2428
- - C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\
    3⤵
    PID:2832
- C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fur\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\
  2⤵
  PID:636
- - C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\
    3⤵
    PID:1680
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\data.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\
      4⤵
      PID:1956
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\
      4⤵
      PID:1236
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\
      4⤵
      PID:1032
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\
      4⤵
      PID:1276
- C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ga\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\
  2⤵
  PID:2520
- C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\
  2⤵
  PID:1616
- - C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\
    3⤵
    PID:380
- C:\Program Files\VideoLAN\VLC\locale\he\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\he\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\
  2⤵
  PID:860
- - C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\
    3⤵
    PID:940
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\data.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\
      4⤵
      PID:2488
    - - C:\Program Files\Windows Mail\de-DE\backup.exe
        
        "C:\Program Files\Windows Mail\de-DE\backup.exe" C:\Program Files\Windows Mail\de-DE\
        5⤵
        
        PID:2656
    - - C:\Program Files\Windows Mail\en-US\backup.exe
        
        "C:\Program Files\Windows Mail\en-US\backup.exe" C:\Program Files\Windows Mail\en-US\
        5⤵
        
        PID:2192
    - - C:\Program Files\Windows Mail\es-ES\backup.exe
        
        "C:\Program Files\Windows Mail\es-ES\backup.exe" C:\Program Files\Windows Mail\es-ES\
        5⤵
        
        PID:2628
    - - C:\Program Files\Windows Mail\fr-FR\backup.exe
        
        "C:\Program Files\Windows Mail\fr-FR\backup.exe" C:\Program Files\Windows Mail\fr-FR\
        5⤵
        
        PID:2816
    - - C:\Program Files\Windows Mail\it-IT\backup.exe
        
        "C:\Program Files\Windows Mail\it-IT\backup.exe" C:\Program Files\Windows Mail\it-IT\
        5⤵
        
        PID:900
    - - C:\Program Files\Windows Mail\ja-JP\backup.exe
        
        "C:\Program Files\Windows Mail\ja-JP\backup.exe" C:\Program Files\Windows Mail\ja-JP\
        5⤵
        
        PID:2592
- C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\
  2⤵
  PID:384
- - C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\
    3⤵
    PID:1656
- C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\
  2⤵
  PID:2092
- - C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\
    3⤵
    PID:268
- C:\Program Files\VideoLAN\VLC\locale\is\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\is\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\
  2⤵
  PID:2928
- - C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\
    3⤵
    PID:2492
- C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kn\
  2⤵
  PID:1056
- - C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\System Restore.exe
    "C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\
    3⤵
    PID:1656
- C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ko\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\
  2⤵
  PID:2212
- C:\Program Files\VideoLAN\VLC\locale\ks_IN\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\ks_IN\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\
  2⤵
  PID:796
- - C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\
    3⤵
    PID:1768
- C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\
  2⤵
  PID:2788
- - C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\
    3⤵
    PID:2748
- C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lt\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\
  2⤵
  PID:2104
- C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\lv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\
  2⤵
  PID:2732
- - C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\
    3⤵
    PID:2916
- - C:\Program Files\Mozilla Firefox\uninstall\backup.exe
    "C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
    3⤵
    PID:912
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\
      4⤵
      PID:1896
    - - C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\
        5⤵
        
        PID:1064
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\
      4⤵
      PID:832
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\
      4⤵
      PID:1380
- - C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
    "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
    3⤵
    PID:2976
- C:\Program Files\VideoLAN\VLC\locale\mk\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\mk\update.exe" C:\Program Files\VideoLAN\VLC\locale\mk\
  2⤵
  PID:380
- - C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\
    3⤵
    PID:2012
- C:\Program Files\VideoLAN\VLC\locale\my\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\my\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\
  2⤵
  PID:2272
- - C:\Program Files\Windows Defender\de-DE\backup.exe
    "C:\Program Files\Windows Defender\de-DE\backup.exe" C:\Program Files\Windows Defender\de-DE\
    3⤵
    PID:3008
  - - C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\
      4⤵
      PID:2592
- C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\
  2⤵
  PID:1896
- - C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\
    3⤵
    PID:2076
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\
    3⤵
    PID:2972
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\
    3⤵
    PID:2492
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\
    3⤵
    PID:2020
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
      4⤵
      PID:2392
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
      4⤵
      PID:3056
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
      4⤵
      PID:872
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
      4⤵
      PID:2304
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
      4⤵
      PID:768
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\data.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
      4⤵
      PID:796
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
      4⤵
      PID:1540
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
      4⤵
      PID:1000
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
      4⤵
      PID:2692
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\update.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
      4⤵
      PID:1484
  - - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
      "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
      4⤵
      PID:1692
- C:\Program Files\VideoLAN\VLC\locale\nl\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\nl\data.exe" C:\Program Files\VideoLAN\VLC\locale\nl\
  2⤵
  PID:2648
- - C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\
    3⤵
    PID:2644
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\
      4⤵
      PID:2088
- - C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\
    3⤵
    PID:2068
- C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\nn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\
  2⤵
  PID:2036
- - C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\
    3⤵
    PID:2856
- C:\Program Files\VideoLAN\VLC\locale\oc\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\oc\update.exe" C:\Program Files\VideoLAN\VLC\locale\oc\
  2⤵
  PID:840
- - C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\
    3⤵
    PID:2336
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\
      4⤵
      PID:2236
- C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\
  2⤵
  PID:2700
- C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\
  2⤵
  PID:2692
- - C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\
    3⤵
    PID:2060
- C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ps\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\
  2⤵
  PID:2620
- - C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\
    3⤵
    PID:1036
  - - C:\Program Files (x86)\Common Files\Adobe AIR\Versions\update.exe
      "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
      4⤵
      PID:868
- C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_BR\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\
  2⤵
  PID:1604
- - C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\
    3⤵
    PID:1768
- C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\pt_PT\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\
  2⤵
  PID:1508
- - C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\
    3⤵
    PID:1812
- C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ro\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ro\
  2⤵
  PID:2660
- - C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\data.exe
    "C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\data.exe" C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\
    3⤵
    PID:2748
- C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ru\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\
  2⤵
  PID:2640
- - C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\
    3⤵
    PID:2236
  - - C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
      "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
      4⤵
      PID:1300
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\
      4⤵
      PID:2708
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\
      4⤵
      PID:2780
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\backup.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\
      4⤵
      PID:2808
  - - C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\update.exe
      "C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\update.exe" C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\
      4⤵
      PID:2732
- C:\Program Files\VideoLAN\VLC\locale\si\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\si\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\
  2⤵
  PID:1096
- - C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\
    3⤵
    PID:1628
- C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\
  2⤵
  PID:2316
- - C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\
    3⤵
    PID:2600
- C:\Program Files\VideoLAN\VLC\locale\sl\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\sl\update.exe" C:\Program Files\VideoLAN\VLC\locale\sl\
  2⤵
  PID:1184
- - C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\
    3⤵
    PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
    3⤵
    PID:1436
- C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\
  2⤵
  PID:1960
- - C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\
    3⤵
    PID:768
- - C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\
    3⤵
    PID:1968
- C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sv\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\
  2⤵
  PID:2152
- - C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\
    3⤵
    PID:1988
- C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ta\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\
  2⤵
  PID:2256
- - C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\
    3⤵
    PID:1804
  - - C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\data.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\data.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\
      4⤵
      PID:2032
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\
    3⤵
    PID:532
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\
    3⤵
    PID:1980
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\
    3⤵
    PID:636
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System Restore.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System Restore.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\
    3⤵
    PID:1840
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\
    3⤵
    PID:1988
- C:\Program Files\VideoLAN\VLC\locale\te\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\te\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\
  2⤵
  PID:3048
- - C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\
    3⤵
    PID:2632
- - C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\
    3⤵
    PID:2664
- - C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\
    3⤵
    PID:1888
- - C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\
    3⤵
    PID:844
- C:\Program Files\VideoLAN\VLC\locale\tet\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\tet\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\
  2⤵
  PID:2964
- - C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\
    3⤵
    PID:1344
- C:\Program Files\VideoLAN\VLC\locale\th\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\th\data.exe" C:\Program Files\VideoLAN\VLC\locale\th\
  2⤵
  PID:2496
- C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\tl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\
  2⤵
  PID:2560
- - C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\
    3⤵
    PID:1708
- C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\tr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\
  2⤵
  PID:2900
- - C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\
    3⤵
    PID:2104
  - - C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\
      4⤵
      PID:320
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
        5⤵
        
        PID:2296
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\
      4⤵
      PID:2600
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\
      4⤵
      PID:1140
  - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\
      4⤵
      PID:2528
- C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\sq\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\
  2⤵
  PID:1876
- C:\Program Files\VideoLAN\VLC\locale\or\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\or\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\
  2⤵
  PID:2932
- - C:\Program Files\MSBuild\Microsoft\backup.exe
    "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
    3⤵
    PID:2944
- - C:\Program Files\Google\Chrome\backup.exe
    "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
    3⤵
    PID:2876
- C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ne\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ne\
  2⤵
  PID:2160
- - C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\
    3⤵
    PID:2736
- - C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe
    "C:\Program Files\Microsoft Games\SpiderSolitaire\backup.exe" C:\Program Files\Microsoft Games\SpiderSolitaire\
    3⤵
    PID:3048
- - C:\Program Files\Microsoft Games\Solitaire\backup.exe
    "C:\Program Files\Microsoft Games\Solitaire\backup.exe" C:\Program Files\Microsoft Games\Solitaire\
    3⤵
    PID:2228
- - C:\Program Files\Microsoft Games\Purble Place\backup.exe
    "C:\Program Files\Microsoft Games\Purble Place\backup.exe" C:\Program Files\Microsoft Games\Purble Place\
    3⤵
    PID:628
- - C:\Program Files\Microsoft Games\More Games\backup.exe
    "C:\Program Files\Microsoft Games\More Games\backup.exe" C:\Program Files\Microsoft Games\More Games\
    3⤵
    PID:2188
- - C:\Program Files\Microsoft Games\Hearts\backup.exe
    "C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
    3⤵
    PID:1356
- C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ms\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\
  2⤵
  PID:1944
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\
    3⤵
    PID:1996
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\
    3⤵
    PID:1276
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\
    3⤵
    PID:2896
- - C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\
    3⤵
    PID:2164
- C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mr\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\
  2⤵
  PID:2424
- C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mn\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mn\
  2⤵
  PID:2024
- C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ml\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\
  2⤵
  PID:452
- C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\mai\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\
  2⤵
  PID:2876
- C:\Program Files\VideoLAN\VLC\locale\ky\update.exe
  "C:\Program Files\VideoLAN\VLC\locale\ky\update.exe" C:\Program Files\VideoLAN\VLC\locale\ky\
  2⤵
  PID:2076
- C:\Program Files\VideoLAN\VLC\locale\km\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\km\backup.exe" C:\Program Files\VideoLAN\VLC\locale\km\
  2⤵
  PID:1960
- C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\kk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\
  2⤵
  PID:2232
- C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ka\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\
  2⤵
  PID:2112
- C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ja\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\
  2⤵
  PID:2636
- C:\Program Files\VideoLAN\VLC\locale\it\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\it\backup.exe" C:\Program Files\VideoLAN\VLC\locale\it\
  2⤵
  PID:2144
- C:\Program Files\VideoLAN\VLC\locale\id\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\id\backup.exe" C:\Program Files\VideoLAN\VLC\locale\id\
  2⤵
  PID:2672
- C:\Program Files\VideoLAN\VLC\locale\ia\System Restore.exe
  "C:\Program Files\VideoLAN\VLC\locale\ia\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\ia\
  2⤵
  PID:844
- C:\Program Files\VideoLAN\VLC\locale\hy\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\hy\data.exe" C:\Program Files\VideoLAN\VLC\locale\hy\
  2⤵
  PID:2804
- C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ug\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ug\
  2⤵
  PID:2576
- C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\hi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\hi\
  2⤵
  PID:1620
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\
    3⤵
    PID:1040
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\System Restore.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\
    3⤵
    PID:1944
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\
    3⤵
    PID:1668
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\
    3⤵
    PID:2912
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\
    3⤵
    PID:2652
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:1728
  - - C:\Program Files (x86)\Google\Temp\backup.exe
      "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Google\Update\backup.exe
      "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
      4⤵
      PID:1300
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\
    3⤵
    PID:1724
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\data.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\
    3⤵
    PID:2316
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\
    3⤵
    PID:2788
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\
    3⤵
    PID:2192
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\
    3⤵
    PID:616
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\
    3⤵
    PID:1512
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
    3⤵
    PID:996
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
    3⤵
    PID:1064
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
    3⤵
    PID:3048
- C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gl\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gl\
  2⤵
  PID:2816
- C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\gd\backup.exe" C:\Program Files\VideoLAN\VLC\locale\gd\
  2⤵
  PID:2712
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\
    3⤵
    PID:2144
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
    3⤵
    PID:2040
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
    3⤵
    PID:1796
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
      4⤵
      PID:2520
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
      4⤵
      PID:2684
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
      4⤵
      PID:2796
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\System Restore.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
      4⤵
      PID:2748
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
      4⤵
      PID:1812
  - - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
      4⤵
      PID:1748
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
    3⤵
    PID:2660
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
    3⤵
    PID:2908
- - C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
    3⤵
    PID:2924
- C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\fy\backup.exe" C:\Program Files\VideoLAN\VLC\locale\fy\
  2⤵
  PID:2364
- C:\Program Files\VideoLAN\VLC\locale\ff\data.exe
  "C:\Program Files\VideoLAN\VLC\locale\ff\data.exe" C:\Program Files\VideoLAN\VLC\locale\ff\
  2⤵
  PID:1088
- - C:\Program Files\Windows Journal\ja-JP\backup.exe
    "C:\Program Files\Windows Journal\ja-JP\backup.exe" C:\Program Files\Windows Journal\ja-JP\
    3⤵
    PID:2556
- - C:\Program Files\Windows Journal\Templates\System Restore.exe
    "C:\Program Files\Windows Journal\Templates\System Restore.exe" C:\Program Files\Windows Journal\Templates\
    3⤵
    PID:1044
- C:\Program Files\VideoLAN\VLC\locale\et\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\et\backup.exe" C:\Program Files\VideoLAN\VLC\locale\et\
  2⤵
  PID:2316
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\
    3⤵
    PID:1748
  - - C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
      "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
      4⤵
      PID:2796
  - - C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
      "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
      4⤵
      PID:2316
  - - C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
      "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
      4⤵
      PID:2868
    - - C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
        
        "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
        5⤵
        
        PID:1580
  - - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
      "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
      4⤵
      PID:1812
  - - C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
      "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
      4⤵
      PID:1808
- C:\Program Files\VideoLAN\VLC\locale\es\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\es\backup.exe" C:\Program Files\VideoLAN\VLC\locale\es\
  2⤵
  PID:1344
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
    3⤵
    PID:2348
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\update.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
    3⤵
    PID:2500
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
    3⤵
    PID:2360
- C:\Program Files\VideoLAN\VLC\locale\el\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\el\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\
  2⤵
  PID:2996
- C:\Program Files\VideoLAN\VLC\locale\de\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\de\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\
  2⤵
  PID:584
- C:\Program Files\VideoLAN\VLC\locale\da\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\da\backup.exe" C:\Program Files\VideoLAN\VLC\locale\da\
  2⤵
  PID:2568
- C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\
  2⤵
  PID:2848
- C:\Program Files\VideoLAN\VLC\locale\co\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\co\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\
  2⤵
  PID:2164
- C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ckb\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ckb\
  2⤵
  PID:2944
- - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
    "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
    3⤵
    PID:2784
- C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\cgg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\
  2⤵
  PID:2768
- C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ca\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\
  2⤵
  PID:2852
- C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bs\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bs\
  2⤵
  PID:2648
- C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\brx\backup.exe" C:\Program Files\VideoLAN\VLC\locale\brx\
  2⤵
  PID:3008
- C:\Program Files\VideoLAN\VLC\locale\br\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\br\backup.exe" C:\Program Files\VideoLAN\VLC\locale\br\
  2⤵
  PID:2672
- - C:\Program Files\Java\jre7\lib\backup.exe
    "C:\Program Files\Java\jre7\lib\backup.exe" C:\Program Files\Java\jre7\lib\
    3⤵
    PID:2892
- - C:\Program Files\Java\jre7\bin\backup.exe
    "C:\Program Files\Java\jre7\bin\backup.exe" C:\Program Files\Java\jre7\bin\
    3⤵
    PID:2944
- C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn_IN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\
  2⤵
  PID:2364
- C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bg\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\
  2⤵
  PID:2904
- C:\Program Files\VideoLAN\VLC\locale\be\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\be\backup.exe" C:\Program Files\VideoLAN\VLC\locale\be\
  2⤵
  PID:2276
- C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ar\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ar\
  2⤵
  PID:1232
- C:\Program Files\VideoLAN\VLC\locale\an\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\an\backup.exe" C:\Program Files\VideoLAN\VLC\locale\an\
  2⤵
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
    C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
    3⤵
    PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
    3⤵
    PID:2868
  - - C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
      "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft Visual Studio 8\update.exe
      "C:\Program Files (x86)\Microsoft Visual Studio 8\update.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft.NET\backup.exe
      "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
      4⤵
      PID:3048
  - - C:\Program Files (x86)\MSBuild\backup.exe
      "C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\
      4⤵
      PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe
    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
    3⤵
    - Executes dropped EXE
    PID:2336
- - C:\Users\Admin\AppData\Local\Temp\4264310058\backup.exe
    C:\Users\Admin\AppData\Local\Temp\4264310058\backup.exe C:\Users\Admin\AppData\Local\Temp\4264310058\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2504
- C:\Program Files\VideoLAN\VLC\locale\af\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\af\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\
  2⤵
  PID:1956
- C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ach\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\
  2⤵
  PID:1768
- C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\uk\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uk\
  2⤵
  PID:628
- - C:\Program Files\Microsoft Games\Purble Place\it-IT\data.exe
    "C:\Program Files\Microsoft Games\Purble Place\it-IT\data.exe" C:\Program Files\Microsoft Games\Purble Place\it-IT\
    3⤵
    PID:2268
- - C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe
    "C:\Program Files\Microsoft Games\Purble Place\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Purble Place\fr-FR\
    3⤵
    PID:2848
- - C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe
    "C:\Program Files\Microsoft Games\Purble Place\en-US\backup.exe" C:\Program Files\Microsoft Games\Purble Place\en-US\
    3⤵
    PID:1644
- - C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe
    "C:\Program Files\Microsoft Games\Purble Place\de-DE\backup.exe" C:\Program Files\Microsoft Games\Purble Place\de-DE\
    3⤵
    PID:2120
- C:\Program Files\VideoLAN\VLC\locale\uz\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\uz\backup.exe" C:\Program Files\VideoLAN\VLC\locale\uz\
  2⤵
  PID:2492
- C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\vi\backup.exe" C:\Program Files\VideoLAN\VLC\locale\vi\
  2⤵
  PID:2740
- C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\wa\backup.exe" C:\Program Files\VideoLAN\VLC\locale\wa\
  2⤵
  PID:2848
- C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\zh_CN\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_CN\
  2⤵
  PID:2584
- C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\zh_TW\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zh_TW\
  2⤵
  PID:1736
- C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\zu\backup.exe" C:\Program Files\VideoLAN\VLC\locale\zu\
  2⤵
  PID:1484

C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\
1⤵
PID:1808

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:2868
- C:\Program Files (x86)\Common Files\backup.exe
  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
  2⤵
  PID:2764
- - C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
    "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
    3⤵
    PID:1788
- - C:\Program Files (x86)\Common Files\Services\backup.exe
    "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
    3⤵
    PID:2912
- - C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
    "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
    3⤵
    PID:1780
  - - C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe
      "C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\
      4⤵
      PID:1568
- - C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
    3⤵
    PID:1720
  - - C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe
      "C:\Program Files (x86)\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Triedit\
      4⤵
      PID:1828
- - C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
    3⤵
    PID:1036
- - C:\Program Files (x86)\Common Files\Adobe\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
    3⤵
    PID:1516
- - C:\Program Files (x86)\Common Files\System\backup.exe
    "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
    3⤵
    PID:848
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:1728
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:1876
- - C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
    3⤵
    PID:1628
- - C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
    "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
    3⤵
    PID:1944
- - C:\Program Files (x86)\Internet Explorer\es-ES\update.exe
    "C:\Program Files (x86)\Internet Explorer\es-ES\update.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
    3⤵
    PID:1820
- - C:\Program Files (x86)\Internet Explorer\fr-FR\update.exe
    "C:\Program Files (x86)\Internet Explorer\fr-FR\update.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
    3⤵
    PID:1432
- - C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
    "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2336
- - C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
    "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
    3⤵
    PID:2880
- C:\Program Files (x86)\Adobe\backup.exe
  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft Office\update.exe
  "C:\Program Files (x86)\Microsoft Office\update.exe" C:\Program Files (x86)\Microsoft Office\
  2⤵
  PID:2788
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\
    3⤵
    PID:2900

C:\Program Files (x86)\Adobe\Reader 9.0\update.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
1⤵
PID:2040

C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\
1⤵
PID:2280

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
1⤵
PID:1580
- C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
  2⤵
  PID:2920

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
1⤵
PID:1792
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
  2⤵
  PID:1716

C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\
1⤵
PID:2880

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
1⤵
PID:1132

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\
1⤵
PID:2092

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
1⤵
PID:336
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
  2⤵
  PID:1528
- C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
  2⤵
  PID:2052
- C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
  2⤵
  PID:1380
- C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
  2⤵
  PID:2256
- C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
  2⤵
  PID:1524
- C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
  2⤵
  PID:352
- C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
  2⤵
  PID:2920
- C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
  2⤵
  PID:1580
- C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
  2⤵
  PID:2276
- C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
  2⤵
  PID:3028
- C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
  2⤵
  PID:2120
- C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
  2⤵
  PID:1668
- C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
  2⤵
  PID:1576
- C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
  2⤵
  PID:384
- C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
  2⤵
  PID:3060
- C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
  2⤵
  PID:2140
- C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
  2⤵
  PID:2776
- C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
  2⤵
  PID:2040
- C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
  2⤵
  PID:1796
- C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
  2⤵
  PID:1816
- C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
  2⤵
  PID:3012
- C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
  2⤵
  PID:868
- C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
  2⤵
  PID:952
- C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
  2⤵
  PID:2372
- C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
  2⤵
  PID:1988
- C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
  2⤵
  PID:688

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
1⤵
PID:1728

C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
1⤵
PID:1664

C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\
1⤵
PID:2268

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
1⤵
PID:2032

C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\
1⤵
PID:2360

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\
1⤵
PID:2780

C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\
1⤵
PID:2140
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\
  2⤵
  PID:1688
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\
  2⤵
  PID:2040
- - C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
    3⤵
    PID:812
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
    3⤵
    PID:320
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
    3⤵
    PID:1616
- - C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
    3⤵
    PID:2812
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\
  2⤵
  PID:352
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\
  2⤵
  PID:1524
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\
    3⤵
    PID:1988
- C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\
  2⤵
  PID:1372
- - C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\include\win32\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\win32\
    3⤵
    PID:1896
- C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\
  2⤵
  PID:2152
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\
  2⤵
  PID:1088
- - C:\Program Files\Windows Journal\it-IT\backup.exe
    "C:\Program Files\Windows Journal\it-IT\backup.exe" C:\Program Files\Windows Journal\it-IT\
    3⤵
    PID:2164
  - - C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\
      4⤵
      PID:2512
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\
  2⤵
  PID:2896
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\
  2⤵
  PID:3024
- - C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
    3⤵
    PID:628
- - C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
    3⤵
    PID:1240
  - - C:\PerfLogs\Admin\backup.exe
      C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
      4⤵
      PID:2172
- - C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
    3⤵
    PID:2904
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
    3⤵
    PID:2744
- - C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
    3⤵
    PID:336
- - C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
    3⤵
    PID:3016
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\
  2⤵
  PID:2944
- C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\
  2⤵
  PID:2824

C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\
1⤵
PID:872
- C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\
  2⤵
  PID:1808
- C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\
  2⤵
  PID:1508
- C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\
  2⤵
  PID:2192
- C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\
  2⤵
  PID:1612
- C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\
  2⤵
  PID:2280
- C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\
  2⤵
  PID:2520
- C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\
  2⤵
  PID:1688
- C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\
  2⤵
  PID:2000
- C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\
  2⤵
  PID:2716

C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\
1⤵
PID:840

C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\
1⤵
PID:2324

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\
1⤵
PID:912

C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\
1⤵
PID:1944
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\
  2⤵
  PID:1664
- - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
    3⤵
    PID:2024
- C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\
  2⤵
  PID:1356
- C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\
  2⤵
  PID:2212
- - C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe
    "C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\
    3⤵
    PID:1364

C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\
1⤵
PID:1744

C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\
1⤵
PID:996

C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2088

C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\
1⤵
PID:2892
- C:\Program Files\Java\jre7\lib\zi\backup.exe
  "C:\Program Files\Java\jre7\lib\zi\backup.exe" C:\Program Files\Java\jre7\lib\zi\
  2⤵
  PID:1600
- C:\Program Files\Java\jre7\lib\jfr\backup.exe
  "C:\Program Files\Java\jre7\lib\jfr\backup.exe" C:\Program Files\Java\jre7\lib\jfr\
  2⤵
  PID:3028
- C:\Program Files\Java\jre7\lib\images\backup.exe
  "C:\Program Files\Java\jre7\lib\images\backup.exe" C:\Program Files\Java\jre7\lib\images\
  2⤵
  PID:2220
- C:\Program Files\Java\jre7\lib\fonts\backup.exe
  "C:\Program Files\Java\jre7\lib\fonts\backup.exe" C:\Program Files\Java\jre7\lib\fonts\
  2⤵
  PID:2096
- C:\Program Files\Java\jre7\lib\deploy\backup.exe
  "C:\Program Files\Java\jre7\lib\deploy\backup.exe" C:\Program Files\Java\jre7\lib\deploy\
  2⤵
  PID:2832
- C:\Program Files\Java\jre7\lib\applet\backup.exe
  "C:\Program Files\Java\jre7\lib\applet\backup.exe" C:\Program Files\Java\jre7\lib\applet\
  2⤵
  PID:1636

C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Portal\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Portal\
1⤵
PID:2332

C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\PROOF\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\PROOF\
1⤵
PID:2460

C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\
1⤵
PID:1744
- C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\
  2⤵
  PID:328
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\
    3⤵
    PID:2420

C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Stationery\
1⤵
PID:1712

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\
1⤵
PID:1588

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\
1⤵
PID:2544

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\
1⤵
PID:1156

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\
1⤵
PID:2960

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\
1⤵
PID:1000

C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\
1⤵
PID:2260

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\
1⤵
PID:2016

C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\
1⤵
PID:576
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\
  2⤵
  PID:384
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\
  2⤵
  PID:832
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\
  2⤵
  PID:2344
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\
  2⤵
  PID:3012
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\
  2⤵
  PID:2720
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\
  2⤵
  PID:2348
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
    3⤵
    PID:2808
  - - C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
      "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
      4⤵
      PID:2640
  - - C:\Program Files\Mozilla Firefox\browser\features\backup.exe
      "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
      4⤵
      PID:2040
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\
  2⤵
  PID:2972
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\
    3⤵
    PID:2084
  - - C:\Program Files\Common Files\Microsoft Shared\backup.exe
      "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
      4⤵
      PID:3024
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\
    3⤵
    PID:2616
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\
  2⤵
  PID:1616
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\
  2⤵
  PID:1436
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\
  2⤵
  PID:2724
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\
  2⤵
  PID:920
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\
  2⤵
  PID:2412
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\
  2⤵
  PID:2564
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\
  2⤵
  PID:2992
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\
  2⤵
  PID:2844
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\
  2⤵
  PID:2896
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\
  2⤵
  PID:1616
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
    3⤵
    PID:2740
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
    3⤵
    PID:1344
  - - C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\
      4⤵
      PID:1656
  - - C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\Kentucky\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Kentucky\
      4⤵
      PID:2372
  - - C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Indiana\
      4⤵
      PID:1988
  - - C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe
      "C:\Program Files\Java\jre7\lib\zi\America\Argentina\backup.exe" C:\Program Files\Java\jre7\lib\zi\America\Argentina\
      4⤵
      PID:384
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\
        5⤵
        
        PID:2072
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\
        5⤵
        
        PID:1960
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\
        5⤵
        
        PID:2120
      - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
        6⤵
        
        PID:3028
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\
        5⤵
        
        PID:1184
    - - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe
        
        "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\
        5⤵
        
        PID:1684
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\System Restore.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
    3⤵
    PID:2468
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
    3⤵
    PID:2220
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
    3⤵
    PID:2012
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
    3⤵
    PID:1728
  - - C:\Program Files (x86)\Google\CrashReports\backup.exe
      "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
      4⤵
      PID:2280
  - - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\
      4⤵
      PID:2716
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\
  2⤵
  PID:1684
- - C:\Program Files\Reference Assemblies\Microsoft\Framework\data.exe
    "C:\Program Files\Reference Assemblies\Microsoft\Framework\data.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\
    3⤵
    PID:268
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\
  2⤵
  PID:3028
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\
  2⤵
  PID:2596
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\
  2⤵
  PID:2464
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\
  2⤵
  PID:1152
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\
  2⤵
  PID:2564
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\
  2⤵
  PID:832
- - C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\
    3⤵
    PID:2692
  - - C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe
      "C:\Program Files\VideoLAN\VLC\skins\fonts\backup.exe" C:\Program Files\VideoLAN\VLC\skins\fonts\
      4⤵
      PID:1964
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\
  2⤵
  PID:1744
- - C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\
    3⤵
    PID:2780
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\
  2⤵
  PID:2688
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\
  2⤵
  PID:800
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\
  2⤵
  PID:1500
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\
  2⤵
  PID:1516
- - C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
    3⤵
    PID:2016
- - C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
    3⤵
    PID:2880
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\
      4⤵
      PID:2740
  - - C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe
      "C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\
      4⤵
      PID:2768
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\System Restore.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\
  2⤵
  PID:2700
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\
  2⤵
  PID:2172
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\
  2⤵
  PID:2944
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\
  2⤵
  PID:352
- - C:\Program Files\Common Files\System\Ole DB\backup.exe
    "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
    3⤵
    PID:2684
- - C:\Program Files\Common Files\System\ja-JP\backup.exe
    "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
    3⤵
    PID:1792
- - C:\Program Files\Common Files\System\fr-FR\backup.exe
    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
    3⤵
    PID:2180
- - C:\Program Files\Common Files\System\es-ES\backup.exe
    "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
    3⤵
    PID:2032
- - C:\Program Files\Common Files\System\en-US\backup.exe
    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
    3⤵
    PID:532
- - C:\Program Files\Common Files\System\de-DE\backup.exe
    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
    3⤵
    PID:1804
- - C:\Program Files\Common Files\System\ado\backup.exe
    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
    3⤵
    PID:1832
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\
  2⤵
  PID:1588
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\
  2⤵
  PID:2136
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\
  2⤵
  PID:2292
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\
  2⤵
  PID:2328
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\
  2⤵
  PID:2632
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\
  2⤵
  PID:3052
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\
  2⤵
  PID:672
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\
  2⤵
  PID:2804
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\
  2⤵
  PID:2808
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\
  2⤵
  PID:960
- C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\
  2⤵
  PID:1816

C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\
1⤵
PID:3016

C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\
1⤵
PID:452
- C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\
  2⤵
  PID:2164

C:\Program Files\VideoLAN\VLC\lua\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\backup.exe" C:\Program Files\VideoLAN\VLC\lua\
1⤵
PID:1696
- C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\extensions\backup.exe" C:\Program Files\VideoLAN\VLC\lua\extensions\
  2⤵
  PID:320
- C:\Program Files\VideoLAN\VLC\lua\http\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\
  2⤵
  PID:1420
- - C:\Program Files\VideoLAN\VLC\lua\http\dialogs\data.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\dialogs\data.exe" C:\Program Files\VideoLAN\VLC\lua\http\dialogs\
    3⤵
    PID:2804
  - - C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\System Restore.exe
      "C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\System Restore.exe" C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\
      4⤵
      PID:868
- - C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\images\
    3⤵
    PID:868
- - C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\js\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\js\
    3⤵
    PID:2628
- - C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\requests\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\requests\
    3⤵
    PID:2688
- - C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe
    "C:\Program Files\VideoLAN\VLC\lua\http\css\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\
    3⤵
    PID:3032
- C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\intf\backup.exe" C:\Program Files\VideoLAN\VLC\lua\intf\
  2⤵
  PID:2824

C:\Program Files\Windows Defender\backup.exe
"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
1⤵
PID:2272
- C:\Program Files\Windows Defender\it-IT\backup.exe
  "C:\Program Files\Windows Defender\it-IT\backup.exe" C:\Program Files\Windows Defender\it-IT\
  2⤵
  PID:2392
- C:\Program Files\Windows Defender\fr-FR\update.exe
  "C:\Program Files\Windows Defender\fr-FR\update.exe" C:\Program Files\Windows Defender\fr-FR\
  2⤵
  PID:1640
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
    3⤵
    PID:1436
- C:\Program Files\Windows Defender\ja-JP\backup.exe
  "C:\Program Files\Windows Defender\ja-JP\backup.exe" C:\Program Files\Windows Defender\ja-JP\
  2⤵
  PID:1828
- C:\Program Files\Windows Defender\es-ES\backup.exe
  "C:\Program Files\Windows Defender\es-ES\backup.exe" C:\Program Files\Windows Defender\es-ES\
  2⤵
  PID:964
- C:\Program Files\Windows Defender\en-US\backup.exe
  "C:\Program Files\Windows Defender\en-US\backup.exe" C:\Program Files\Windows Defender\en-US\
  2⤵
  PID:1820

C:\Users\backup.exe
C:\Users\backup.exe C:\Users\
1⤵
PID:2956
- C:\Users\Admin\data.exe
  C:\Users\Admin\data.exe C:\Users\Admin\
  2⤵
  PID:2436
- - C:\Users\Admin\Desktop\backup.exe
    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
    3⤵
    PID:2656
- - C:\Users\Admin\Documents\backup.exe
    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
    3⤵
    PID:2904
  - - C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\
      4⤵
      PID:1988
- - C:\Users\Admin\Links\backup.exe
    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
    3⤵
    PID:1140
- - C:\Users\Admin\Music\backup.exe
    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
    3⤵
    PID:2520
  - - C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe
      "C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\
      4⤵
      PID:2872
    - - C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\
        5⤵
        
        PID:1748
    - - C:\Program Files\Microsoft Games\Chess\en-US\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\
        5⤵
        
        PID:2732
    - - C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe
        
        "C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\
        5⤵
        
        PID:2736
- - C:\Users\Admin\Favorites\backup.exe
    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
    3⤵
    PID:2380
- - C:\Users\Admin\Downloads\backup.exe
    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
    3⤵
    PID:996
- - C:\Users\Admin\Contacts\backup.exe
    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
    3⤵
    PID:2100
- - C:\Users\Admin\Pictures\data.exe
    C:\Users\Admin\Pictures\data.exe C:\Users\Admin\Pictures\
    3⤵
    PID:2392
- - C:\Users\Admin\Saved Games\backup.exe
    "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
    3⤵
    PID:2620
- - C:\Users\Admin\Searches\backup.exe
    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
    3⤵
    PID:2168
- - C:\Users\Admin\Videos\backup.exe
    C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
    3⤵
    PID:1420
- C:\Users\Public\backup.exe
  C:\Users\Public\backup.exe C:\Users\Public\
  2⤵
  PID:2940

C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\
1⤵
PID:2932
- C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\
  2⤵
  PID:2172

C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe
"C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\
1⤵
PID:1976
- C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\backup.exe" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\
  2⤵
  PID:2304

C:\Program Files\Windows Journal\backup.exe
"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
1⤵
PID:1088
- C:\Program Files\Windows Journal\en-US\backup.exe
  "C:\Program Files\Windows Journal\en-US\backup.exe" C:\Program Files\Windows Journal\en-US\
  2⤵
  PID:2744
- C:\Program Files\Windows Journal\es-ES\System Restore.exe
  "C:\Program Files\Windows Journal\es-ES\System Restore.exe" C:\Program Files\Windows Journal\es-ES\
  2⤵
  PID:1180
- C:\Program Files\Windows Journal\fr-FR\backup.exe
  "C:\Program Files\Windows Journal\fr-FR\backup.exe" C:\Program Files\Windows Journal\fr-FR\
  2⤵
  PID:2292
- C:\Program Files\Windows Journal\de-DE\backup.exe
  "C:\Program Files\Windows Journal\de-DE\backup.exe" C:\Program Files\Windows Journal\de-DE\
  2⤵
  PID:560

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\
1⤵
PID:1772

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TextConv\
1⤵
PID:2572

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\
1⤵
PID:812

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\
1⤵
PID:2636
- C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\
  2⤵
  PID:1636

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\
1⤵
PID:2556

C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\
1⤵
PID:2668
- C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\data.exe
  "C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\
  2⤵
  PID:1608

C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\
1⤵
PID:2392

C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\
1⤵
PID:2936

C:\Program Files\VideoLAN\VLC\plugins\backup.exe
"C:\Program Files\VideoLAN\VLC\plugins\backup.exe" C:\Program Files\VideoLAN\VLC\plugins\
1⤵
PID:1644

C:\Windows\backup.exe
C:\Windows\backup.exe C:\Windows\
1⤵
PID:860

C:\Program Files\Windows Mail\backup.exe
"C:\Program Files\Windows Mail\backup.exe" C:\Program Files\Windows Mail\
1⤵
PID:2488

C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\
1⤵
PID:2616

C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\
1⤵
PID:1748

C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\
1⤵
PID:2760

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
1⤵
PID:2720

C:\Program Files (x86)\Common Files\microsoft shared\DW\data.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DW\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
1⤵
PID:1696
- C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\meta\backup.exe" C:\Program Files\VideoLAN\VLC\lua\meta\
  2⤵
  PID:2700
- C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\modules\backup.exe" C:\Program Files\VideoLAN\VLC\lua\modules\
  2⤵
  PID:2360
- C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\playlist\backup.exe" C:\Program Files\VideoLAN\VLC\lua\playlist\
  2⤵
  PID:1180
- C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe
  "C:\Program Files\VideoLAN\VLC\lua\sd\backup.exe" C:\Program Files\VideoLAN\VLC\lua\sd\
  2⤵
  PID:2544

C:\Program Files (x86)\Common Files\microsoft shared\DAO\System Restore.exe
"C:\Program Files (x86)\Common Files\microsoft shared\DAO\System Restore.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
1⤵
PID:2076

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\
1⤵
PID:2796

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\
1⤵
PID:2364
- C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe
  "C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\
  2⤵
  PID:1032

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\update.exe
"C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\update.exe" C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\
1⤵
PID:1068

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
1⤵
PID:2288
- C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
  2⤵
  PID:2576

C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\
1⤵
PID:1952

C:\Program Files\VideoLAN\VLC\skins\backup.exe
"C:\Program Files\VideoLAN\VLC\skins\backup.exe" C:\Program Files\VideoLAN\VLC\skins\
1⤵
PID:2692

C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe
"C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\backup.exe" C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\
1⤵
PID:800

C:\Program Files\Windows Media Player\backup.exe
"C:\Program Files\Windows Media Player\backup.exe" C:\Program Files\Windows Media Player\
1⤵
PID:2428

C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe
"C:\Program Files\VideoLAN\VLC\hrtfs\backup.exe" C:\Program Files\VideoLAN\VLC\hrtfs\
1⤵
PID:3052

C:\Program Files\VideoLAN\VLC\backup.exe
"C:\Program Files\VideoLAN\VLC\backup.exe" C:\Program Files\VideoLAN\VLC\
1⤵
PID:2228
- C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\ja-JP\backup.exe" C:\Program Files\Microsoft Games\Solitaire\ja-JP\
  2⤵
  PID:1788
- C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\it-IT\backup.exe" C:\Program Files\Microsoft Games\Solitaire\it-IT\
  2⤵
  PID:1528
- - C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe
    "C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\
    3⤵
    PID:1060
- C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Solitaire\fr-FR\
  2⤵
  PID:760
- C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\es-ES\backup.exe" C:\Program Files\Microsoft Games\Solitaire\es-ES\
  2⤵
  PID:788
- C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\en-US\backup.exe" C:\Program Files\Microsoft Games\Solitaire\en-US\
  2⤵
  PID:1656
- C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe
  "C:\Program Files\Microsoft Games\Solitaire\de-DE\backup.exe" C:\Program Files\Microsoft Games\Solitaire\de-DE\
  2⤵
  PID:2560

C:\Program Files\VideoLAN\backup.exe
"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
1⤵
PID:1512

C:\Program Files\Reference Assemblies\backup.exe
"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
1⤵
PID:1532

C:\Program Files\Mozilla Firefox\backup.exe
"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
1⤵
PID:2732

C:\Program Files\Microsoft Office\update.exe
"C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\
1⤵
PID:2748

C:\Program Files\Microsoft Games\backup.exe
"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
1⤵
PID:2160
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\update.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\update.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\
  2⤵
  PID:908
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
    3⤵
    PID:1660
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
    3⤵
    PID:3056
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
    3⤵
    PID:844
- - C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
    3⤵
    PID:760
- C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe
  "C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\
  2⤵
  PID:1768

C:\Program Files\Windows NT\backup.exe
"C:\Program Files\Windows NT\backup.exe" C:\Program Files\Windows NT\
1⤵
PID:1748

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\backup.exe" C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\
1⤵
PID:2360

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\data.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\data.exe" C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\
1⤵
PID:2180

C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\lib\
1⤵
PID:2676

C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe
"C:\Program Files\Java\jdk1.7.0_80\jre\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\bin\
1⤵
PID:1804

C:\Program Files\Windows Photo Viewer\backup.exe
"C:\Program Files\Windows Photo Viewer\backup.exe" C:\Program Files\Windows Photo Viewer\
1⤵
PID:2320

C:\Program Files\Java\backup.exe
"C:\Program Files\Java\backup.exe" C:\Program Files\Java\
1⤵
PID:800

C:\Program Files\Internet Explorer\update.exe
"C:\Program Files\Internet Explorer\update.exe" C:\Program Files\Internet Explorer\
1⤵
PID:2132

C:\Program Files\Google\backup.exe
"C:\Program Files\Google\backup.exe" C:\Program Files\Google\
1⤵
PID:2932

C:\Program Files\DVD Maker\Shared\backup.exe
"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
1⤵
PID:2104

C:\Program Files\DVD Maker\ja-JP\backup.exe
"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
1⤵
PID:2824

C:\Program Files\DVD Maker\fr-FR\backup.exe
"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
1⤵
PID:2856

C:\Program Files\DVD Maker\en-US\backup.exe
"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
1⤵
PID:764

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:2804

C:\Program Files\DVD Maker\backup.exe
"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
1⤵
PID:2128

C:\Program Files\Windows Portable Devices\backup.exe
"C:\Program Files\Windows Portable Devices\backup.exe" C:\Program Files\Windows Portable Devices\
1⤵
PID:1824

C:\Program Files\Common Files\backup.exe
"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
1⤵
PID:2084

C:\Program Files\7-Zip\backup.exe
"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
1⤵
PID:2940

C:\Program Files\backup.exe
"C:\Program Files\backup.exe" C:\Program Files\
1⤵
PID:2860
- C:\Program Files\Windows Sidebar\backup.exe
  "C:\Program Files\Windows Sidebar\backup.exe" C:\Program Files\Windows Sidebar\
  2⤵
  PID:2128

C:\PerfLogs\backup.exe
C:\PerfLogs\backup.exe C:\PerfLogs\
1⤵
PID:1240

C:\System Restore.exe
"\System Restore.exe" \
1⤵
PID:1900

C:\Users\Admin\AppData\Local\Temp\3890531ec3647f7cf92db12648795871.exe
"C:\Users\Admin\AppData\Local\Temp\3890531ec3647f7cf92db12648795871.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
1KB

MD5
e63a7c029300ad9025a6af766763f65c

SHA1
f9c0f5ac4786af176b0f7d9fe6556a9d4226159a

SHA256
3604434e4961435adc19ab5a701472e4f7f8e8b4eabee26e128d795310b408b6

SHA512
2510bfee2e4d2a7e6641512b3bd4c6f7feb8ad9e94649ac9de85fae612f8cd43cfc57b620c9154802b105af356db9d07894ed122d745ebeb9d08f2339b9eb930

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
65KB

MD5
b74dd6a2c8c643bc4824f70360ec6355

SHA1
4eeb3ade35d2dd96bfe872843a06edcbf318faf8

SHA256
8fe7a08e5bc5da1f7d96c5bec01544f4ff5c65a6e17afa01d60fc94c4a8e85b7

SHA512
6e6f0ef76b358a7deace6994e2019e5320e7a6690d9f36ce6ef0102c61cdd30501be95a735c16956da6e66c12c010f5e4b5a7af7169c5176fba857dd44360d60

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
25ec8162ebbb0cfe0177b640125bdf63

SHA1
7c6014078b307543db9d556aab88cf06308e738b

SHA256
9f155d1218f49d871fbe8af4b6c893378ff42ae2ac9fab5cc3dc25a3892effd6

SHA512
7e7a8bb7da09dcf3106922bf54bd39ff0899fd7f9911c5b048a067334403b11f6ad5a395faca04489c9f8f5da792c560c0b445c6fe056c3746b55e0d53ab3704

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
33KB

MD5
ff53042449386c241a020e0e392b6947

SHA1
641281f3e6898c6f453369849ada60c28f191677

SHA256
0b430e2be3ba94c813ad37a5eccf7a3282661432d0c1395301fc7d0af24389e8

SHA512
190e8545dddaf6b08be9a90acf0015e3bdcebc9ccd1f089b32000fe7c37f5c58a094bdd56373f60b1a154ac22c5a38aad0594c557bc017fa9940a2d4a2345011

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
72KB

MD5
847400e513b7418f44bc73fcf68b642e

SHA1
e5c21e31cf7626ed6d6558a8b75cb7084692ce52

SHA256
484efb4875a0d7dbe35d1309787c8134779dc97a112030965e5107a8bf11f6a8

SHA512
1dadbc62903587b30450c1cd3e5ccb53dfae796defb5ddb92bf909ac72276d38057f0c1309bbe630caee89ae4eaf7c4f04e84a70ad175e01479da5945933c929

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
d17abc16aa75eed322e6d17ce551ba8d

SHA1
fbc1b36458c35dbcf8931df69e13f597bf1cd5d7

SHA256
bd932a8c21b1a5070123bac58f3e079609d97ff279a3b8f8e1382b38d4dd51c8

SHA512
48296bb8ed847244f530d5ea00ed6bbed5ffca10cd216cb520ba5a738178fefd59707c04e8dbbbf267777eff0456fcf0e4057e26e33fc6d956684f91b231016f

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
f47c0b63dbcd1023b1be796014e01f5c

SHA1
1154dcef25273d032025150505c1a0feeb5c659a

SHA256
1d6ea890c6c7c5eb1a56ebd909004ae5213ea106c2a8d8cb38551fd9567a83ca

SHA512
13470ad0d40ae4b27e2eee366ec124d943e19125ec8f7b2072bb5586ca6425552690f30fee443ada660a82ca200b7a20bdc69ec658dca32f5b9ba628e0a71958

Download Submit
C:\System Restore.exe

Filesize
72KB

MD5
82b1de2be28f74740a4c9324cfed88d8

SHA1
6c96ab8058df6064b8f3aa7016d71c3104bc1b0d

SHA256
f3450ae4099b82f56805b59a640f35e6dc4452663ca2450950483059f6fb2bcc

SHA512
b966217f878218d86942fe25c22e489edaf2fcbacad1bc283dab0348ca61b5ae12efede81745568c52859c73654c927b3d9fef9f1f2466821e4e1f805e7f53d2

Download Submit
C:\System Restore.exe

Filesize
38KB

MD5
27879cee2b10bd9b30c780dd2f434a72

SHA1
76a51603505117c489b322dda3be958069e2ab9b

SHA256
9baa8e6a544a67a4b8abc7b67037ad80aeee910d6af436d6f2a61f0bf02be6bc

SHA512
729d2b65a1db22bf64ad39d8d02668fd15632b744796e969d44bd79ed032409debabc5c065eb17ca98585462d8dfdd4da0ceefe1ace524073d9839f6e3d757bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\4264310058\backup.exe

Filesize
72KB

MD5
6aa80fecce9ed5d41d072eca8e821215

SHA1
fdebb62790046aed6b17961acfcdd1dcd59e21e4

SHA256
30fcf322842febc7b13bbd886b9aa121290a50ff320d0bdf8559a5f6bae36053

SHA512
956b82c1e73d24b66965f7db234213236d817e80390be7b9f5e8181040637c431317f45f857866bfdac717bbf3e8de1c83470f0e18401fa50c4500cf5d8109d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe

Filesize
6KB

MD5
06f9257e112dd8126c4f6edc76a04b88

SHA1
4176badbf5344040e09f5e4bbcca042cea808688

SHA256
188516b5a3a77f08884eb0211075025185e13e0443131bd7f3e080a567b70649

SHA512
34855fc55122b5573ff25026ab3481ab45efb44d07e46367f6301fec4e96591b42ffdd7e8c058be122534304b52ffc7cecf75e6f527b6d5ed10a0c39b537411e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
39KB

MD5
17cef2d180c1c2ed368ee0025cc458c8

SHA1
22f93b4da0fd007aa6b3d94515d0ec2ab7561b24

SHA256
a171a9e62ae2e350ec95d2b98566462cebdd20d539cf37fab6877998341f24f6

SHA512
1c573119c2982d5ab6acbcc174ec9004f67a1a51be5f0066ca2c77babebc0d6310d40f3703b712c91603e91b9db8fdd73a2a15b0baca2690c96f8c18b4381116

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe

Filesize
37KB

MD5
8f6a35a71f9ae5788e2657e5df6308be

SHA1
23ce8404a5084ab396445244c47b17951d98b637

SHA256
c9f68a4b7cfe18d115f60ee8c1f61d2f8e66cb56c90de182bf0c6045f877d031

SHA512
fe32e6dfeba58f5ecdcec357bc84282b127845471c5707c87dd1c8f9203316f506640837136af466084ceb45c3195ebcb924c9834065f9aba225b87236acc9d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\backup.exe

Filesize
45KB

MD5
e9995b42ba2f6c32e2bfdeb3763da534

SHA1
d40bfba289ac1ea681cd21a6db618c566606b541

SHA256
13bc4f96f74b35fe7e4c1d2c4c490995f386b94a03d80fd8e624307f388e392f

SHA512
dcd1866114d8670a7dc299890c73bd3e9ac54bafaa60dbd920bf852421afaecb6eda7aebafa184a5858a3ec578a0a6f5a5c9cc074b637197cc78983ca44f82e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\backup.exe

Filesize
46KB

MD5
79de52e1ca439b82261b1cfbefa3fa0e

SHA1
c005736d202ee12f3b7d5b0b68df30b9e0ed5a4d

SHA256
a5e6cbf099f5d04d7c8048e1f6277a90572dfb47f7e757c3b9ec57d8cc22699a

SHA512
28d318ca7ee63730908f02a19a2f1a7ca1142ae3ef2767883eaac83684de695485e144fc724d185d05d3c3f4b93044d608ec543a09ec5553a5b85a7a9fcd320d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\backup.exe

Filesize
63KB

MD5
6d0d6c0c3fe5f26e4996402bdf1f05a2

SHA1
3e17fa2e00a923da7de764f857cbccb2f90f37db

SHA256
34c12487320b9e108a1de822180f107bc6d6687832ddbbf0735184d0f28ea741

SHA512
baad1a7e876ff954702a6f938dbf29cc17a33701461a29298d512a183b487bdd8ffb56ecf1973c9c0270f6774f601e773afcc712b45c36627eb7a6f19e2c660c

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
21KB

MD5
3172dc83a62446075380bd703ab551f7

SHA1
3b3ead34301463ef6c7827a3e596b83db6a34dba

SHA256
716674c501b4d31726bb674c7232755ded9368faa3a5bcfbaf7094c3c0dc081e

SHA512
ce9f838f79f1563604a518b3ea2e91be4e99cee06d0ac1605370ec608ffd61d4fe1d5933e4d942bba73b1e8203ac1dc028664c76bbd1bd4847ebcfa9135d7ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
56KB

MD5
412a870de998703ffb056604dd643f51

SHA1
4fb87599c42f709512ae6db2fda4118b8b7d57de

SHA256
33528cfec5d7928f10da734169004fae5dace49652b87b0edef085e53e346745

SHA512
309f39b13763ac46c029dceeba1ed664d0d690f397d2c98f1377357a69140d2474d08003a43ea02495e4de6c71ad78a1c41beacc8013ed13afda5afcfd3c85e8

Download Submit
\Program Files\Common Files\backup.exe

Filesize
14KB

MD5
c57e07dbc80cb5780944bbba2d04c16d

SHA1
7a843917516382a9739fb097e17ab09defa4ff65

SHA256
10723cf2cec01eb33f61b2bf757828f09a6f1f3b488059e6a4b56d40b3b19e99

SHA512
1a7be7b5af5c5f0638d92ad5e2bbdb06072958c933b10bd4c3200d67f1a934089c9e582f99f46a89e86c56f285d1a7115a616e68014e416edf78a8e454132df2

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\System Restore.exe

Filesize
59KB

MD5
50ef807c373d444f70764efb41e8615a

SHA1
05cb74e2fb0b10dcfefe76443f4ae3b3e5268cd3

SHA256
6037ef22c1d72cfd4bd275c75e06847816a756158616a697bea2bf3b1313b90e

SHA512
8f06c954154c5e5e0a9168ca293150fa461460acdddb31154798e617fb234c9c883a21dacd473e651031d7e3d26b6cf29b3d041d0724f66f300deebc684e3a11

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
31KB

MD5
4564e17797b1be7596178b017c368d77

SHA1
d080552fcb5746f34a1cb77f9628f019b000ce61

SHA256
989b640d9d864fd7ffd613cd2a8c4e074a90f1c3349823a7e6ec4cebd24471cc

SHA512
c8c6fa902ce3f98ce36db327d92a38b7a30dde0e2647193a68f1743e88e4912678278763e13550c73d2d67e54f7690ce3516ffb3f60de602e9b9aebfdcdae5e0

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
59KB

MD5
6d8fa048f30e9b3403ccaa8dd794b6d9

SHA1
5251b1b1eb9926faf255092494ad4239978388a5

SHA256
ec620bf37a7b0f3b4877eebd2bb37c28703dfa61d8c4961d8647ce868bcf642f

SHA512
70daf15b79efdac7bd4b761e17c4eb853eaad807d8af671a39968e2b550cbdd49e9dfeef580402c64f1f8a9690b0f87cb876051334bb06915bd46736c4a13153

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\backup.exe

Filesize
72KB

MD5
2c3a9bc581158ff4fa5a7daec7e3e625

SHA1
1b349c950380a04f2c26b5d9f65559a15e92ce77

SHA256
a5f5528defb50a97d74d52e134292962594ac6a1400df71c9fa8260285b29706

SHA512
f0211059975890b79d3c6bd1f7acff2c45fe57b0fcda6245e8c81dd4454973afcb323b3a9676e6b0dde997db6a0a1d63e4f95f390b0b6ba935b7b2453bb5559a

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\CRX_INSTALL\backup.exe

Filesize
39KB

MD5
428a87c2bb7f60fdb617ba5e69b413e3

SHA1
fd1c0e51bd129c469d29cc749c52445a4952657b

SHA256
11fa5431733e6675add8b5a1bc836c3f430bb72f7e6d25882331e35f6f596cdb

SHA512
d293b5a26cec5770c1dcfbb2e85f3a0676ed2fc3c29a7e87d85922440385b0a186c9371628b2ecc0941ab991f73ae43b0e29066bee8f4d855636d3e61c3eb47b

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\backup.exe

Filesize
31KB

MD5
6e9f498d5ecc259a48143ac0a2c26d68

SHA1
8784232923172335f2f7633f2a8a5cb8badb11ab

SHA256
6ac239d562fc62d78b7cc1dd2f7ea0f77ed633a8a6cbab5b6db338fa9bb55307

SHA512
a333440854ce9efed47df05fa5f19f9407369f3e9d8fe3c530953f5bf3e052bdc55e610794bab30cd706a2cc9d940e069822cb1dc186b9725df80132aab29f28

Download Submit
\Users\Admin\AppData\Local\Temp\scoped_dir2056_789028685\backup.exe

Filesize
36KB

MD5
c0f7ab9c6ab5804d5d875edf85b7ad6b

SHA1
787b878c41a7b15d2622faa19fb4397140b8ac27

SHA256
2da7c76295dcd2e30f382dd4f679f44351dd6cb2e3c413384cd20f4086d1a43c

SHA512
9e3ad467938979aaec5866e9095b5724b274dabe114b78045d24dab721c878107347b1cbe3ead2169407b0d6ae6570c5953bc7b1659d6603e29f15966be6f74d

Download Submit
memory/1956-2302-0x0000000002BA0000-0x0000000002CB0000-memory.dmp

Filesize
1.1MB

Download
memory/2928-98-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads